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The integrated mode management interface 


1. Introduction 

Mode management is the processes of understanding the character and 
consequences of autoflight modes, planning and selecting the engagemen , 
disengagement and transitions between modes, and anticipating automatic 
mode transitions made by the autoflight system itself The state of the art is 
represented by the latest designs produced by each of the major airframe 
manufacturers, the Boeing 747-400, the Boeing 777, the McDonnell Douglas 
MD-11, and the Airbus A320/A340 family of airplanes. In these air P lan ^ 
autoflight modes are selected by manipulating switches on the control pan . 
The state of the autoflight system is displayed on the flight mc^e 
annunciators. The integrated mode management interface (IMMI) s 
graphical interface to autoflight mode management 

equipped with flight management computer systems (FMCS). The ^ 
consfsts of a vertical mode manager and a lateral mode manager. Autoflight 
modes are depicted by icons on a graphical display. Mod « sele ^ on 
accomplished by touching (or mousing) the appropriate ^ on , The ^ f 
provides flight crews with an integrated interface to autoflig sys s * 
aircraft equipped with flight management computer systems (FMCS). 

The current version is modeled on the Boeing glass-cockpit airplanes 
(747-400 757/767). It runs on the SGI Indigo workstation. A working 
prototype of this graphics-based crew interface to the autofll 8^ ^°^ 
management tasks of glass cockpit airplanes has been installed in t e 
Advanced Concepts Flight Simulator of the CSSRF of NASA Ames Research 

Center. 

This IMMI replaces the devices in FMCS equipped airplanes currently 
known as mode control panel (Boeing), flight guidance control panel 
(McDonnell Douglas), and flight control umt (Airbus). It also augme 
functions of the flight mode annunciators. All glass cockpit airplanes are 
sufficiently similar that the IMMI could be tailored to the mode management 
system of any modern cockpit. The IMMI does not replace the functions of the 

FMCS control and display unit. 

The purpose of the IMMI is to provide flight crews with a shared 
medium in which they can assess the state of the autoflight system, take 
control actions on it, reason about its behavior, and communicate with each 
other about its behavior. The design is intended to increase mode awarene 
and provide a better interface to autoflight mode management. 

This report describes the IMMI, the methods that were used in 
designing and developing it, and the theory underlying the design and 
development processes. 
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2. Theoretical stance. 

Every designed device instantiates a theory about the nature of the 
operator and the task(s) to be done with the device^ The present generation o 
interfaces is based on a model of cognition in which the person takes in 
information, codes it symbolically, and operates on the internal symbolic 
representations. Such a model of cognition predicts that operators will be a 
to make use of external representations that are already symbolic co 
current mode management interfaces represent autoflight modes as text 
strings. Many other instruments in the "glass-cockpit" do the same. 

The need to provide operators with the right information at the right 
time, and to avoid overwhelming the operator with too much information is 
widely recognized. This need has led to many efforts to manage information 
displays in various clever ways. However, simply controlling wha 
information is presented when is not enough. How information is 
represented is also important. In fact, it may be more important than efforts 
to reduce the "amount" of information presented. 

The study of culturally-elaborated, naturally-occurring distributed 
cognitive systems leads us to consider how people accomplish cognitive work 
bv 8 establishing coordination with structure in the environment. This view 
p^s more emphasis on the role of perception and action in cognition than on 
centralized symbolic processing (See Clark, in press). Recent work in 
embodied and situated cognition question the fundamental status of sym 
processing as a model of internal cognitive processes. In the place ot 
symbolic processing, we see processes in which internal structure is broug 
into coordination with environmental structure. The theory that is 
instantiated in the IMMI is the theory of distributed cognition. (Hutchins, 

1995a). 

A new understanding of the role of cognitive artifacts has emerged in 
the last decade. Rather than amplifiers of abilities, cognitive artifacts are seen 
as elements that participate in cognitive functionalsystemsthat tramcend e 
boundaries of the individual. (Cole and Griffin, 1981; Hutchins, 1995a, 
Norman, 1993; Hutchins, in prep). In these functional systems, cognitive 
work is done via the propagation and transformation of representational 
state. Symbolic rules provide one way to transform representational state, but 
this is a relatively expensive sort of process for humans. To estab is 
coordination between text representations of autoflight modes and conceptua 
representations of those modes takes considerable effort (Sherry and Poison, 

1996). 

The analysis of the use of speed bugs in a modern airline cockpit 
(Hutchins, 1995b) has lessons for the design of airspeed instruments and the 
IMMI as a whole. Traditional round-dial speed instruments give the pilot 
perceptually salient structure that corresponds to important conceptual states. 
This is lacking in the existing tapes ( and in existing interfaces in genera ). 
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These material structures provide the operator with the perceptual raw 
materials for the construction of coherent conceptual understandings. 
Conceptually important conditions should be perceptually distinguishable 
from one another. This means more than simply using graphics instead of 

text. 

Designing perceptual distinctions that mirror conceptual distinctions 
accomplishes several goals at once. First, it puts reasoning into the 
interaction with the external world where it can be accomplished by fast 
robust perceptual processes rather than by slow, vulnerable conceptual 
processes. . It makes visualizing the consequences of mode engagements easy 
to do. Second, it supports reasoning as an activity undertaken jointly by crew 
members sharing the activity 

When we move the boundaries of the unit of analysis out to 
encompass functional systems that transcend the boundaries of the 
individual, we not only find processes at work that we might not have 
suspected, but we also find new places to locate designed activities. It suggests 
designing crew activities rather than designing just objects or artifacts. 

A popular strategy in AI in general and in cockpit automation is to use 
automation to build intelligent agents or expert assistants to help human 
operators. This strategy recreates a number of already difficult problems wit 
communication (and intent inferencing. ) A different strategy is to use 
computing power to create worlds where operators get to be smart while 
using simple cognitive processes. An examination of existing highly 
culturally elaborated action environments shows how they work to make us 
smart. Section 3 below shows how we can use these ideas as design criteria. 

In the next section, I will use this theory to interpret the significance of 
observed problems. 

As a final note, it is important to focus on what goes right in current 
operations as well as on what goes wrong. The existing aviation system is 
very robust and error tolerant (Palmer, et.al, 1994). Many things really do go 
right in modern mode management. It is as important to understand these 
phenomena and to capitalize on the principles underlying them as it is to see 
why things go wrong. 
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3. Observed problems. 

Mode management is a problem. The fact that flight crews are 
sometimes surprised by autoflight system behaviors is well doc ^ e , n ^ in 
Wiener's (1989) study of the 757 flightdeck. When flight crews ask What s it 
doing now?" and wonder how to make the plane do certain things, there is 
problem. Problems with mode management are also easy se ® Q in , 

reports. Vakil, et.al. (1996) surveyed reports for the years 1990-1994 and fo 
184 reports in which crews reported automation surprises. Palmer, et al. 
K a study of altitude deviations reported to ASRS document several 
cases in which flight crew uncertainty about the behavior of glass coc pi 
automation led to altitude busts. 

Symptoms of this problem show up in a variety of places in the 
aviation industry. For example, many Boeing customers who come to Boeing 
for Sng, asktoat their crews not be taught the WAV functions of the 
FMCS. These airlines instruct their crews to make all of their altitude 
changes in Flight Level Change (FLCH) mode. United Airlines does not teach 
WAV operation in its training center 1 . In both cases, the reason given is 
that WAV is too complex to teach. In both cases, it is expected a 
competence required to use this aspect of the system will be acqrured on the 
line" as a consequence of learning (and teaching) in actual operations. 
Another major carrier (Southwest) has placed metal covers over the VNAV 
and LNAV mode select switches on their 737 mode control pane sop 
crews from using those modes. 

Jean Pinet, president of Airbus Industrie subsidiary Aeroformation 
describing new A-320 training program called Aircrew Integrate 
Management (AIM), recently said, 

"We took a prudent approach when we saw the proliferation of f^ght 
modes and configurations on the A320 and other modern aircraft.... We did 
not want to teach all of the combinations; we kept a 'classic approach where 
the training emphasis was on those configurations that seem the best adapt 
to each of the flight procedures." (Lenorvitz, 1992) 


1 I believe that the manufacturers have a special responsibility to provide the 
very best training possible. The operators look to the manufacturer as the 
source of training concepts as well as hardware. An America West training 
captain complained that Amercian West does not provide conceptual training 
in the use of the FMCS because none is available from Boeing. 
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The authors of the AIM program should probably be congratulated for 
their operations-centered approach to training. Still, the proliferation of 
modes is perceived as a problem, and the solution taken has often been to 
teach only a subset of the full system capabilities. Presumably this is because 
the entire system is thought to be too complex for the instructional designers 
to describe, too complex for the instructors to teach, too complex for the pilots 
to learn, or all of the above. 

Autoflight logic is too complex to be easily understood, even, 
apparently, by the engineers who created it. The logic diagrams that describe 
the behavior of the system in all anticipated conditions typically span dozens 
of pages. Much of this complexity arises from rarely encountered conditions. 
Still the actual behavior of the autoflight system in operational 
circumstances can be baffling (Wiener, 1989). In spite of this complexity, 
pilots should and do develop simplified models of what the autoflight system 

is doing. 

The decisions to avoid teaching some parts of flie autoflight system are 
symptoms of serious problems with the new generation of highly automated 
aircraft. Granted that vertical navigation involves the constant interaction of 
thrust, flight path and speed, there is no need for it to be this difficult. The 
engineers have created a system of great utility, but the interface to it is 
conceptually so difficult that operators have given up trying to train their 
crews to operate and trust instead to the pilots, as a community, to discover 

and transmit ways of using it in flight 2 . 


The difficulties that pilots have with mode management are 
understandable given the nature of the current system. This goes for all 
major airframe manufacturers. The differences between Boeing and Douglas 
mode controls is insignificant. Airbus has a different philosophy, but it may 
actually be more challenging to the pilot than the American systems because 
even more is hidden from the pilot in the Airbus airplanes. 


3.1. Autoflight modes 

An autoflight mode is a means of linking a performance target (speed, 
or path) to a control axis (pitch, roll, thrust). It has been said that the flight 
management computer system (FMCS) has replaced the autopilot in the 
current generation of flightdecks (Robert Dorsett, sci.aviation). This is a 


2 Just what it is that pilots are inventing to deal with automated flight modes 
that are not taught in schools is a very interesting topic that deserves 
systematic study. 
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misconception. The autopilot remains as an alternative to the human pilot 
as a way of manipulating the control surfaces of the airplane. What has 
changed is the way of specifying and computing the targets that autopilot may 
be asked to achieve. The FMCS provides new classes of abstractly specified 
targets for the Autopilot flight director system (AFDS) which can then be 
achieved either by the pilot acting on the controls to track flight director cues 
or by the autopilot servos acting on the controls. 

The introduction of automation is not often driven primarily by 
cognitive considerations, but it inevitably has powerful effects on cognition. 
Automation on the flightdeck is changing both the cognitive tasks that are 
faced by individual crew members and changing the cognitive properties of 
the flightdeck itself as a cognitive system. 

Although cockpit automation has touched all aspects of flightdeck 
operations, it has probably had more impact on flight path management than 
on any other aspect. Through the years there has been a continual process of 
upgrading and adding new devices and new functions in support of aircraft 
flight path control. The innovations have come in waves as technologies 
have matured and made new sorts of operations possible. Unfortunately, the 
consequence of this process has been the accumulation of a set of poorly 
integrated devices and functions for flight path management. 

3.2. Flightdeck Automation 

Consider a brief history of flightdeck automation beginning with the 
Boeing 727. 

The 727 flightdeck 3 is a "round-dial” or "steam-gauge" system. The 
instrumentation is based on electromechanical gauges. Flight path is 
controlled primarily through the flight controls: control column, rudder 
pedals, thrust levers, flap handle, trim switches, spoiler lever, landing gear 
handle, etc. There is a rudimentary autopilot which is capable of holding an 
already established altitude, maintaining a heading, tracking a VOR radial, 
and holding an attitude. There is an altitude alerting system, which provides 
warnings on approaching or deviating from a selected altitude, but it is not 
connected to the autopilot system and the airplane is not capable of capturing 
an altitude. Horizontal situation (heading and positional relation to a 
specified VOR radial or localizer course) are displayed on a Horizontal 
situation indicator. DME (distance measuring equipment) provides 
information about distance from station. Considerable cognitive processing is 
required to construct and maintain situation awareness in this sort of 
flightdeck. The representations that are provided by the instrumentation 


3 I use the 727 as a representative of a class of airplanes. The 737 
models prior to the -300, and the older DC-9 models prior to the MD-80 are 
comparable. 
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must be coordinated with other representations in the form of air navigation 
charts. 

The DC-10 4 represents another step in flightdeck automation. It is still 
a "round-dial" flightdeck, but it contains several new features^ T ^e au topilot 
is much more capable. It can not only hold an altitude or track a VOR radial, 
it can capture a specified altitude and capture a radial or a localizer, 
autopilot is capable of controlling pitch to produce a specified target vertica 
speed There is also an autothrottle system which is capable of control mg 
engine thrust in two modes: a thrust reference mode in which a particular 
thrust parameter (e.g., Nl) is tracked, and a speed mode in which thrust is 
varied to track an airspeed target. The control of the autopilot and the 
autothrottle are brought together on an autopilot panel mounted in the 
glareshield. The airspeed, altitude, heading and vertical speed targets ° e 
provided to the autoflight systems are entered on this panel. Modes of 
operation are armed for engagement or selected by button presses and switch 
throws on this panel. The selected, armed or engaged modes of flight control 
are annunciated on a Flight Mode Annunciator panel Some of the longer- 
range models of the DC-10 were also equipped (retro-fitted?) with RNAV 
(inertial navigation) systems that are capable of flying off-airway tracks to 
distant navigation fixes specified by latitude and longitude. 

The MD-80 added to this a "performance box" which can be used to fly 
more fuel efficient climbs, cruises and descents. This Performance 
Management System (PMS) is a precursor of the current VNAV functions of 
the FMS. The computations of the performance system can be coupled to the 
Flight Director and to the autopilot if desired. Inputs to the performance 
system are made with a small limited keyboard (digits 0-9 plus characters N, E, 
S W and /) and PMS data entry and computed data are displayed in a 4 line 
24 character per line display. The MD-80 also has coupled autopilot approach 
and autolanding capability to Category III minimums. 

The Boeing 767/757 5 marked another jump in flightdeck automation. 
In this airplane, the performance box expanded to become the Flight 
Management Computer system. This coupled a comprehensive navigation 
data base with autotuning of navigation radios and automatic position 
updating. A two-dimensional color lateral navigation display replaced the 
HSI 6 . CRT displays driven by symbol generators provide great display 


4 Early versions of the Boeing 747 and the Me Donnell Douglas DC-9 
have comparable flightdeck designs. 

5 The Boeing 737-300, and the McDonnel Douglas MD-88 have 
comparable flight deck designs 

6 An HSI type display can still be presented by the symbol generators 
that drive the computer displays. There are operational reasons for prefering 
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plasticity. The inertial reference systems support navigation displays that 
show motion in either track up or heading up modes. They also permit 
computation and display of ground speed and true wind - items that were 
simply not possible to compute in earlier technologies. 

The plasticity of navigation displays permits the superimposition of 
other kinds of information onto the depiction of the aircraft track. Nearby 
airports, navigation aids, and weather radar returns can all be superimposed 
on the depiction of lateral flight path. Information about the vertical aspect of 
flight path can be added in the form of data blocks attached to waypoint icons. 
LNAV provides facilities for flying complete complex lateral paths that 
consist of a succession of geographic waypoints. Off airway navigation, 
complete approach procedures, and autolandings are also supported. 

Complex vertical profiles can be specified and flown in VNAV modes. The 
757/767 also introduced additional autothrottle modes. Altitude callouts 
were added as part of the newest GPWS systems. 

All of these new facilities increased the capabilities of the aircraft 
autoflight systems, but also created new systems for the crew to monitor and 

supervise. 

The present state of the art in flightdeck design is represented by the 
Airbus A-320, the McDonnell Douglas MD-11 and the Boeing 747-400. These 
airplanes have full EFIS 7 . Full EFIS means that the airspeed, altitude and 
vertical speed instruments are also CRT presentations. This permits soft bugs 
for altitude and airspeed as well as for heading, decision height and 
minimum descent altitudes. As an acknowledgment of the importance and 
difficulty of keeping track of autoflight modes, the Flight Mode Annunciators 
(FMA) have been improved, and consolidated. 

There is no doubt that these innovations have transformed the 
activities of flight crews, changed the cognitive requirements of flight, and 
changed the properties of the flight deck as a cognitive system. It is easy to 
focus on the shortcomings of the automation, but any evaluation of this 
technology must take full account of the increased functionality and ease ot 
operation provided by these systems. In some cases the automation makes 
possible things that could simply not be done without it; autoland in 
zero/zero conditions being perhaps the most striking example. In other cases, 
crew workload is dramatically reduced; flying a DME arc approach procedure 


is an example. 

Modern flight decks present many alternatives for linking elements of 
descriptions of the aircraft flight path to autoflight systems. One pilot boasted 
to me that there are six ways to climb or descend the 737-300. The Operations 


this old-style display to the map display in some circumstances. 

7 All except the standby instruments are now on glass. The Boeing 777 
may have even the standby instruments on glass. 
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manual for the MD-88 lists four ways to climb, but on closer inspection one 
discovers that there are actually eleven different mode configurations 
involved in these climb methods. 

These alternative methods provide the pilots with functional 
flexibility, but the space of possible linkages is large and complex. Mode 
changes occur at pilot command, but also automatically without pilot action 
under many conditions. Automatic control modes may revert to other mo es 
as a consequence of pilot action, due to changing flight circumstances, and 
due to equipment or signal failure. It is not always apparent which mode 
combination will best accomplish the desired goals. Modes of operation carry 
with them other implications, so that what appears to be a good solution (and 
may be at the moment) could become an unsatisfactory solution as flig 
conditions change. For example, in the Boeing airplanes, the vertical speed 
mode provides no stall protection in climb. A rate of climb that is perfect y 
safe at low altitude may lead to a stall at high altitude. 

Even if a pilot knows which mode to select, it is not always clear how 
to select the desired mode. Some modes will only arm under certain 
circumstances and may then only engage when other conditions are met. n 
most cases, the limiting conditions for mode arming and engagement are not 
represented anywhere in the flightdeck system (except in the mind of the 
pilots if they remember the criteria). 

As serious as not being able to engage a desired mode is the inability to 
disengage an undesired mode. This is sometimes an even more subtle 
problem that mode engagement (Sarter & Woods, 1994) Some methods o 
engaging one mode may unintentionally lead to the disengagement of other 

modes (Palmer, et al, 1994). 

Even though autoflight modes are annunciated, it is not clear at all 
times which modes are actually engaged or what the engaged modes imply 
about aircraft performance. These problems may be due to the following 
factors: 1) the annunciations are sometimes cryptic (see discussion of mode 
names below), 2) the annunciated modes combine with each other in 
complex ways; there are modes for thrust, armed captures, roll and pitch 
guidance, 3) Mode transitions can occur without pilot intervention and 
sometimes without apparent change in aircraft behavior, 4) the mode 
annunciations are not prominently displayed, 5) pilots often take the state o 
the MCP or FGCP as a mode indicator (which it is not), 6) some modes have 
very complex behaviors, what Vakil, et.al. (1996) call multi-input multi- 
output (MIMO) controllers. 

The complexity of the autoflight systems requires the crew to reason in 
a complex space about not only the situation of the aircraft and its flight 
configuration, but also about the configuration of the automatic systems. 

This creates situations in which pilots are unsure what is being done by 
which "intelligent" agents. Pilots are very careful about making clear which 
pilot "has the airplane", and usually communicate efficiently about their 


10 



IMMI 


Hutchins 


intentions. In interaction with sophisticated automation, however, it is 
sometimes not clear to the crew who (or what) has what part of the airplane 
and what the automated systems' intentions are. Glass cockpit crews ^ 
occasionally ask aloud, "Why's it doing that?", "What's it doing, now? , Is it 
supposed to do that?" (Wiener, 1989). When unexpected mode behavior 
occurs, there is little support in the modern cockpit for determining the cause 
or communicating about the state of the system. 

Most (but, alas, not all) mode selections are made by taking action on 
the MCP. The language of execution is button presses and switch throws on 
the MCP. And on the MCP, there is feedback for the flight crew about the 
actions they have taken. Flow-bars in the switches on the MCP indicate that a 
selection has been made. For some, but not all, of the switches an illuminated 
light means that the mode can be disengaged by selecting the switch again. 
The proper evaluation of the consequences of mode selection actions taken 
on the MCP cannot be made on the MCP. Instead, evaluation takes place in a 
different language, the language of flight mode annunciation and in another 
place, on the FMA panel (Douglas) or on the PFD (Boeing). 


3.2.1 Failure of integration: the flightdeck tower of babel 

The introduction of several waves of automation over the years has 
made the modern flightdeck a tower of babel. Flight path information is 
expressed in at least ten different identifiable languages: 1. Spoken ATC, 2. 
Written IFR shorthand, 3. Primary flight control positions, 4. MCP 
selections, 5. FMA indications, 6. Primary flight display indications, 7. 
FMCS/CDU character strings, 8. Navigation Displays, 9. Published 
navigation charts and plates, and 10. The behavior of the a * rcra f* 

Some pilots have observed that this list is too short, since the FMS/CDU, the 
navigation displays, and navigation charts may each contain a number of 
languages themselves. In a typical approach to landing, the crew will 
interpret, manipulate, and translate expressions in and among all of these 
languages (except perhaps 2). 

In some cases, the multi-voicedness of the flightdeck is useful. The 
costs of computing some result in a representation that is not well suited to 
the computation may be greater than the costs of translating the problem into 
another representation and solving the problem there. For example, weather 
avoidance planning can be done on the basis of printed descriptions of the 
locations of weather fronts, but it is so much easier to do the planning on a 
chart that it may be worth plotting the locations of the fronts on a chart before 
attempting to formulate a plan for avoiding the weather. 

The descriptions of flight path that are supplied to the autoflight 
systems always ultimately decompose to heading, altitude, airspeed, and 
implicitly, time. The bottom region of Figure 1 shows the basic control loops 
of the modern aircraft. These are unlikely to change much in the foreseeable 
future. The upper region shows, from the bottom up, the layering of 
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increasingly complex specifications of flight path that have been introduced 
over the years. This corresponds to the discussion above of the history of 
flightdeck automation. The right hand column of the upper section of figure 
1 lists the media in which the constraints to be satisfied are represented at 
each level. 

Given the state of the art in technology, there is no need to have this 
many representations. What we see now is a consequence of a particu ar 
history of innovation. A considerable reduction in complexity is possible 
through an integration of these languages into a smaller number of ways to 
represent and evaluate flight path information. There is probably no need to 
eliminate specific functions nor should the ability to revert to simpler 
descriptions when they are needed be sacrificed in the interest o 
simplification. The issue concerns the representational media in which the 
descriptions are composed and in which the adequacy of the descriptions is 
evaluated. 
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Figure 1. (Previous page) showing how descriptions of flight path are 
linked to the flight controls. 

Descriptions of flight path can be linked to the flight controls either by 
way of the autopilot servos, or via the flight director and pilot inputs to the 
controls. The modes concerning lateral navigation of the airplane are called 
roll modes because they achieve their goals primarily through the control of 
the roll attitudes of the airplane. The modes concerning the vertical 
navigation of the airplane are called pitch modes because they achieve their 
goals primarily through control of the pitch attitudes of the airplane. The 
modes concerning the thrust of the engines are called autothrottle modes 
because they primarily act through the autothrottle system to control engine 
thrust. 

In the 747-400, there are 7 roll modes, 9 pitch modes, and 5 autothrottle 
modes. Logically 315 mode combinations are possible! Fortunately only 
about 60 of these logical possibilities actually occur. That is still a large space 
of modes to think about. Is there any way to simplify the conception of the 
space of modes and the problems of mode management? 


3.3. Operational incidents 

The following selection of incidents (most observed from the jumpseat 
on actual revenue flights) will serve to illustrate a number of categories of 
operational problems with autoflight mode management. Many of these 
incidents represent instances of problems that have been identified in other 
contexts, training, simulator flights, and in other studies of aviation 
automation. Each incident will be analyzed as a small case study. A 
theoretical interpretation of the cognitive sources of the incident will be 
given. The theoretical interpretations of the problems lead to design goals for 
a system in which the observed problems can be expected to occur less 
frequently. Furthermore, the theoretical interpretations should support 
design goals that will not only fix the observed problem, but other potential 
problems as well. (e.g. what are called "metabutton" effects observed in some 
lateral navigation events argue for the elimination of metabutton effects in 
all contexts of the interface.) 

In section 5, actual design decisions based on the design goals are 
described. One can then come back to the described incident and ask how the 
system with the new design would operate in the circumstances described in 
the incident. 

These incidents and their theoretical interpretations were also used in 
the design of the flight scenarios used in the evaluation of the IMMI 
described in section 6 below. 

It is widely acknowledged that vertical navigation presents more 
difficulties for flight crews than horizontal navigation. (Vakal, et.al., 1996). 
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Horizontal or lateral navigation is simpler than vertical navigation because it 
is governed by a single roll axis, roll, and because it is supported by the lateral 
navigation display (moving map). There are, however, still some observed 
mode management problems in the domain of lateral navigation. We will 
begin with a few of these. 


3.3.1. Modify RTE, execute, and then... 

Climbing out the airplane was given a vector to intercept a 
published SID routing. The airplane was then given a vector for 
traffic that was not a vector to intercept. Finally the aircraft was 
cleared to resume the departure. At that point, the captain set up 
the intercept by modifying the RTE-LEGS page of the CDU, but did not 
press the NAV button to arm the lateral navigation function. As a 
result, the aircraft flew, in heading select mode, through the 
departure route by about 2 miles. The captain noticed the deviation 
of the airplane symbol from the magenta track on the navigation 
display, ND, and brought the airplane around with heading select. He 
then selected NAV, which engaged. No mention of a deviation from 
course was made by ATC. The captain subsequently complained that 
the automatics had failed to capture the route. 

This a classic case of Poison calls an "and then" problem (Poison: 
cognitive walkthroughs). The modification to the route is made on the 
MCDU, (and in Boeing airplanes, is executed there). If a mode that uses the 
modification is not already engaged, it is then necessary to arm that mode on 
the MCP. This additional action is difficult to remember because it is carried 
out in a different place from the route modification actions and because the 
execution of the modification has the feel of a completion to the route 
modification plan. Design goal: Route modification and mode selection 
should take place in the same location as a single course of action. The IMMI 
does not address the problem of route creation and modification. A second 
design goal is to make the distinctions among modes more perceptually 
salient and conceptually meaningful on the NAV display. This can easily be 

done. 


3.3.2. Engage LNAV with active waypoint on wingtip 

Just prior to top of descent, the aircraft was given a vector 
for traffic. When the captain attempted to re-engage NAV, the 
aircraft made an unexpected turn to the right. The captain engaged 
heading select and spun the heading bug to the left to reintercept the 
FMC route as displayed on the ND. After the airplane was again 
established on a heading to intercept the route, the captain selected 
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NAV and the plane made another unexpected turn. He went back to 
heading select. Finally, he was able to get NAV to engage and 
continue on course as he wanted it to. 

The cause of this unexpected behavior by the autoflight system is that 
while being vectored the airplane had almost, but not quite, passed the active 
waypoint. With the active waypoint having a relative bearing of less than 90 
degrees it will not transition. The airplane was trying to fly to a waypoint 
that was nearly abeam of the plane, thus entering an unexpected steep turn. 

This problem has been observed in actual and simulated flights in 
many glass cockpit airplanes. It is possible that some crew members consult 
neither 8 the ND nor the ACT F-PLN or RTE-LEGS pages of the FMS before re- 
selecting NAV. For those who do consult the ND, the active waypoint is not 
saliently marked on the ND. Down-course waypoints are white, the active 
waypoint is magenta. That makes sense because the active route is displayed 
in magenta, and for the sake of consistency, all items depicted m magenta are 
elements of the active route. Unfortunately, there is a conflict here between 
consistency and discriminability. That is, the inactive waypoints are 
perceptually easier to find on the display than the active waypoints. This is 
because the white symbology contrasts with the magenta route line while t e 

magenta symbology blends into it. The white symbology also has a better 

contrast with the display background. Design goal: Make the active waypoint 
perceptually more salient on the lateral navigation display. 

The deeper problem here is that the NAV button on the GCP (or 
LNAV button on the MCP) is what Ev Palmer (Palmer, personal 
communication) has called a "meta-button." The structure of the button 
itself contains no information about the content of the mode that it selects. 
The meaning of the button is "fly the lateral route described in that active legs 
page beginning with the active waypoint." The route description is available 
on the RTE-LEGS page of the CDU (which might not be visible when mode 
selections is made, and on which the information is in text form), and in 
graphical form on the NAV display (but as noted above, the active waypoint 
is not salient), but this information is not represented in any way on the 
glareshield where the mode selection is made. The act of selecting the mode 
can proceed to conclusion without the pilot processing any representation o 
the content that will be evoked by the engaged mode. This is what makes 
unintended outcomes possible. Design goal: Require the operator to process 
the content of the mode in the act of selecting any mode. A simple way to do 
this is to have NAV mode selected by touching the active waypoint icon on 
the NAV display. This requires a bit more work than pressing the NAV 
button on the GCP because the pilot must first find the active waypoint in 
order to touch it. This search and touch activity make the spatial relation o 
the active waypoint to the airplane apparent to the pilot. This extra work is 
part of the work the pilot should always do before engaging the mode m any 
case. The wider design implication is that for all modes, the action taken to 
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select or engage the mode should somehow bring the operator into contact 
with easy to process representations of the specific consequences of engaging 
that mode. 


3.3.3. Heading bug behind the airplane 

This one was observed in a simulator flight rather than in revenue 
service. 

The departure SID contains a turn of nearly 180° early in the 
procedure. The heading bug is lined up with the runway for takeoff. 
LNAV is engaged after liftoff and the procedure is flown as depicted. 
After turning more than 90°, ATC calls traffic and asks for a turn. 
The crew engages heading select, but now finds that the heading bug 
is behind the airplane and not visible on the nav display. The 
airplane continues its uncontrolled turn until the crew can spin the 
bug around in front of the airplane. 

The root of the problem here is that the button press that engages 
Heading Select mode is a meta-button. Its meaning is roll to capture the 
heading indicated by the current position of the heading bug (wherever t a 
mav be). The current position of the heading bug is indicated as a number ot 
degrees in the window above the heading select knob. This representation 
does provide some information, but it is not in a form that is easy to process. 
Suppose ATC said turn left 15° for traffic. One would have to read one s 
current heading, and then subtract 15° to get the desired heading. Now 
suppose the desired heading is 320 and the heading window reads 130 which 
way should one spin the bug to get it to the desired heading? The act that 
engages the mode does not require the crew to process any aspect of the 
heading that will be selected. The crew may use the heading window to 
determine the current location of the heading bug, but this representation is 
not easy to process. Furthermore, the heading bug itself is only visible when 
it is ahead of the airplane symbol on the navigation display. When the 
heading bug is on a heading that is behind the airplane, the bug itse is 
hidden. Many instructors and line pilots emphasize the importance of 
establishing a habit of keeping the heading bug in front of the airplane in 
order to eliminate this problem. 

Design goal: Like the problem with wingtip LNAV, the solution to the 
meta-button problem here is to require the crew to process the content of the 
mode that will be selected in the act of selecting the mode. In this case, that 
can be accomplished by having heading select mode be selected by touching 
the heading bug on the NAV display. This implies another design goal, 
having the heading bug always be visible on the NAV display. ^ further goa 
is to have the display itself change in some way to indicate that the heading 
bug is going behind the airplane. 
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We now turn to the more complex, and less well supported, task of 
vertical mode management. 


3.3.4. Unexpected leveloff at crossing restriction 

The Peble One departure out of San Diego includes an at-or-below 
altitude restriction early in the SID. This restriction protects airspace used by 
fighters operating out of Mirimar Naval Air Station. I have observed this 
departure from the jumpseat many times. Out of 5 departures I observed 1 
757s three crews were surprised by an unexpected leveloff at this altitude 
restriction. Other researchers (Palmer, Degani) flying this leg in 757 have a so 
observed this problem. The following two incidents are typical. 

Peble incident 1: The Peble one departure was selected to go 
with the company route. The departure clearance was to 14 thousand. 
The crew briefed the departure and put 8000 in the altitude window 
“just to be safe.” After TOGA, the climb was commenced in FLCH 
and LNAV. Out of 4,000, the aircraft was cleared unrestricted to 
14,000. The crew put 14,000 in the window, and engaged VNAV. 
Approaching 8,000’, the aircraft began to leveloff. The Captain 
said, "Oh, I know what it's doing" and selected FLCH. He then 
deleted the restriction from the RTE-LEGS page and reengaged 

Peble incident 2: The crew carefully briefed the departure, and 
talked about the restriction. They put the company route with the 
Peble 1 departure in the CDU. After takeoff the aircraft was 
cleared unrestricted to 9000'. The airplane leveled at 8000. It 
took quite a while for the crew to figure out why it leveled off. The 
FO finally pushed FLCH to resume the climb. By the time they began 
to remove the restriction, the waypoint had transitioned. 

In these two cases, the MCP window altitude seems to be the most 
salient representation of anticipated flight path. The restriction to pass a 
waypoint at or below 8000' is visible as text on the RTE LEGS page of the CDU, 
but is not obvious even if that page is displayed. In each case, the clearance to 
climb unrestricted should lead the crew to delete the restriction from the 

FMS. 

In a third case involving this departure (reported by Palmer, personal 
communication b), the crew were required to meet the altitude restriction. 
They did so successfully, but while trying to confirm that they had done so, 
they failed to continue the climb after the waypoint as expected. 

The problem here is that the relevant system state - the representations 
of the altitude restriction - are weak and possibly hidden. Sherry and Poison 
(1995) discuss this sort of unexpected level-off as an example of the weakness 
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of current mode annunciation systems. Design goal: provide a graphical 
representation of the future vertical trajectory of the airplane. Just as the 
lateral navigation display makes the lateral path visible, a vertical navigation 
display could represent the vertical path. It should be noted that there are 
many problems with constructing vertical situation displays. 


3.3.5. Unexpected level-off at cruise altitude 


The aircraft was climbing out to the west with VNAV, LNAV 
and right autopilot engaged. Out of FL240 the aircraft was cleared 
to FL350. The captain put 35000 in the MCP altitude window. The 
FMS had been programmed for an initial cruise at FL310. (It is not 
known why the clearance did not match the programmed cruise 
altitude). The airplane was handed off to a new sector at about 
FL300. As the Captain began to check in, the airplane began to 
capture FL310 so he said, "Callsign 281, leveling at FL310." The 
controller replied: ”1 thought you were cleared to FL350, Sir." The 
captain glanced at the altitude window (he must have immediately 
figured out what happened), and said: "Yes, I guess we were, but 
we’d like to stay here if the ride has been okay here. 


In this case, it is not clear that the captain had well formed expectation 
concerning the behavior of the airplane, but he and the FO were surprised 
that the airplane had leveled off before reaching the altitude in the MCP 
window. The problem here is that there are multiple descriptions of flight 
path these descriptions are not always consistent with one another, and 
which of the descriptions is actually controlling depends on situationa 
factors. The mismatch between the representation of flight path programmed 
into the FMC and the representation on the MCP leaves the behavior o e 
airplane ambiguous. The MCP representation occupies a more central 
Son in ^cockpit, but in this case, the less accessible FMC representahon 
is the controlling representation. Again, the difference between what is 
programmed into the FMS (not immediately accessible - but operative) and 
what is displayed on the MCP (immediately accessible -but not necessarily 
operative) led to an altitude awareness problem. These discoordinations are 
symptoms of the complexity of operation via the two different interfaces 
located in different parts of the cockpit. 


Design goal: To have a single representation in which all descriptions 
of flight path are displayed in such a way that it is easy to determine w c 
will be controlling in any situation. 
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3.3.6. Failure to note FMA change 


Navigation error on the Border 3 departure. Just before 
reaching the turn at PGY 19 DME cleared direct PGY. FO programs 
FMS, Capt goes to heading select. I think he went for a 080° heading 
(the final inbound course to PGY if the whole SID was flown.) With 
the FMS programmed, should have gone back to LNAV. I think the FO 
did not know that the capt had selected heading select. So FO 
believed LNAV still selected. 080° heading brought us over North 
Island. Capt noticed then and reselected LNAV. 


This should have been easy to see on the annunciators on the PFD, but 
I have heard many complaints by crew that they do not use the annunciations 
as much as they should. Autoflight instruction packages always stress: 

"When you make a change up here (MCP), you've gotta look down here (PF 
annunciations) to make sure you really have what you think you have. 

The problem here is that the annunciations are cryptic and not salient. Also, 
lateral mode status is not indicated on the map display itself. Design goa . 
indicate lateral mode status on the map display, and do it is a way that makes 
the mode annunciation perceptually salient. 


3.3.7. Unanticipated automatic mode transitions 

VNAV PTH reverts to VNAV SPD mode without warning in 
overspeed descent. Sherry and Poison (1995) also discuss this automation 
behavior as a context for crew confusion. Vakil, et.al. (1995) describe three 
kinds of mode transitions: commanded mode transitions, immediate 
consequences of crew mode selections; uncommanded transitions, usually 
invoked by the automation as envelope protection; and 
automatic/conditional transitions, such as when an armed mode engages. 
Design goal: Indicate impending uncommanded, and automatic/conditional 

mode transitions. 


3.3.8. Knowing which modes can be engaged when. 

On the climb we were given a speed restriction to maintain 
250 until further advised. It wasn't until we were out of FL250 that 
we got econ speed. I was looking at the captain's climb page and 
could see that econ speed was 309 KIAS or Mach .797. I wasnt 
exactly sure how to get back to econ speed since we had the speed 
intervention showing in the window 250. When the captain asked the 
FO to restore the econ speed, the FO reached up and pressed the 
VNAV button. VNAV was already engaged though, so this had no 
effect. (Note: part of the logic of the system is that modes are 
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normally only dis-engaged by the selection of another mode.) The 
captain pointed to the speed select knob, making a pressing motion, 
the FO pressed the knob. The window blanked and the command speed 
bug jumped up to the econ speed. 

Technically, this is not a mode change. It is instead a change in the 
target for the engaged mode. Still, it presents a problem for the crew. There 
is nothing to tell the pilot that econ speed target will be restored when one 
pushes that knob, or even that the knob is pushable. This is a case of more 
hidden system state. Design goal: represent engaged, armed, and selectab e 
modes and their performance targets (speed, path) explicitly. 

This raises the more general issue of knowing which modes can be 
selected for engagement at any point in time. 


3.3.9. Why SPD is not selectable when in FLCH, VNAV or 

TOGA. 

At the end of a VNAV-PTH descent, the FO wanted to reduce 
speed. He reached up and pressed the SPD button on the MCP. 

Nothing happened. He pressed it again, and still nothing happened. 

He pressed it five times in all before giving up and selecting 
vertical speed (which automatically activated SPD mode). 

In this example, it is clear that the FO did not know that the SPD mode 
is not available for selection when in FLCH, TOGA, or any VNAV mode. A 
pilot could memorize this fact, but there are many other facts just like it. 
Fortunately, there is a simple conceptual regularity m the system that implies 
this constraint. This regularity will be presented below in the discussion of 
the conceptual organization of autoflight functions. A better solution would 
be to base one's knowledge of this constraint on the underlying regularity. 
Unfortunately, the existing interface masks the underlying conceptual 
regularities that govern the behavior of the autoflight system. Design goal: 
Present for selection, only those modes that can be engaged or armed from t e 
current operating mode. Design goal: Associate salient perceptual regularities 
in the display with the underlying conceptual regularities that govern the 
behavior of the autoflight system. 

3.3.10. Mode selection in wrong operational context: Killing the 

capture 

Palmer (1994) reports a case from a simulated flight in which a pilot 
intending to soften a level-off maneuver caused a failure to capture the target 
altitude In some automated airplanes, pilots find the level-off maneuver to 
be somewhat abrupt. One way to provide more passenger comfort is to select 


21 




EMMI 


Hutchins 


V-SPD mode prior to the capture and to reduce the vertical rate at which the 
target altitude is approached. This normally works fine. If however, the 
selection of V-SPD is made after the altitude capture has begun, the selection 
of the new mode will "Kill the capture." In the case observed by Palmer, the 
new mode selection came less than a second late. Since modes are not 
annunciated in the same place where mode selections are made, there is a 
possibility that the operating context could change between the time the puo 
decides on an action and when the pilot takes the action. Design goal: Put the 
means of evaluating the current state of the system, making changes to the 
system, and assessing the consequences of changes all in the same location. 

As long as the parameters of flight path are specified through the CDU, 
the autoflight modes that link those parameters to the controls are selected 
via actions on the MCP, the consequences of mode selection actions are 
evaluated on the FMAs and the compliance of the airplane with the specme 
parameters is monitored on the PFD and ND, there will be problems e 
those observed in these flights. These flightdecks scatter flight path displays 
and controls all over the instrument panel. 

3.4 Mode Naming 

A lexicon for verbally representing the states and guiding one's own 
and the attention of the other pilot is needed. How are pilots going to talk 
about what they see and what they are doing on this interface? This raises the 
issues of mode naming. Currently, the mode naming and the representations 
of the modes are a single system. The mode names appear as text in the mode 
annunciation. Pilots refer to the modes by their text names or phonetic 
variants of them. Because of display space constraints, most text 
representations of mode names are contractions of longer words^ Sometimes 
pilots use the longer words - expanding the contraction, e.g. LvlChg= Level 
change. Sometimes they coin a new phonetic token based on the contraction, 
e.g. FLCH = flitch. Even within the current system of mode naming it is 
possible to make improvements along the lines of the theory presented here. 
That is, conceptually similar modes could have conceptually similar names. 
Some of this is present in a partial compositional structure of names. For 
example, the vertical navigation modes in which performance targets are set 
by the FMCS all begin with the character string "VNAV". One can see why 
engineers would name modes this way. Grouping modes that are controlled 
by the FMCS reflects both the history of the introduction of modes and the 
nature of the data flow within the autoflight system. However, there are 
other ways to group modes. For pilots, the source of the target may not the 
most important feature of modes. From an operational perspective, VNAV- 
SPD may be more similar to FLCH (both are pitch to target speed modes) than 

it is to VNAV-PTH. 

The general problem here is that the mode space is multi-dimensional, 
and text string annunciations tightly constrain the number of independent 
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features that can be meaningfully distinguished in the representation of 
modes The hyphenated mode names convey only two dimensions, the 
graphical depictions of the IMMI permit simultaneous representation of a 
wider range of features - up to four dimensions simultaneously. However, 
regardless of the capabilities of graphic displays, the mode naming issue 
remains a factor in crew communications and reasomng about modes. 

Airbus naming conventions may have some advantages because they are 
more explicitly compositional. For example, the difference between what 
Boeing calls VNAV-SPD climb and FLCH climb is noted in the Airbus syste 
as the difference between managed speed climb and selected speed climb. 

3.5 Folk models: 

The failure of the current interfaces to provide the crew with the raw 
materials necessary to construct coherent models of the conceptual 
organization of autoflight, and the failure of most manufacturer and airline 
training programs to teach the conceptual structure of autoflight leaves to 
pilots themselves the job of trying to come up with conceptual models to 
understand the behavior of the systems they use. Unfortunately, the 
regularities that are most important are often masked in the current designs. 

Sometimes, these folk models are quite good. In some cases they are 
charmingly naive, and on other cases they are probably quite dangerous. Here 
is an example of a naive model. Most airlines specify a procedure for 
autopilot use in which the autopilot that is used to control the airplane 
should not also be used to drive the flight director of the pilot flying, n 
airplanes with three autopilots, the center autopilot is usually engaged. In 
two autopilot airplanes, the autopilot on the side opposite the pilot flying is 
used. One captain told me that you can't use same autopilot to drive the 
servos and to generate the f/d command bars. His folk theory to account for 
this fact was a resource limitation argument. He claimed that the box can t 
drive both at once. That's why with 3 autopilots, we normally use center in 
command." A better reason is that if an autopilot fails active, you don t wan 
it sending bad information to both the f/d command bars and to the servos. If 
these are on separate boxes, then if the one driving the command bars fails, 
the airplane will continue flying fine. If the one driving the servos fails, the 
pilot will be able to use the command bars to recover. 

The MCP is not completely lacking in conceptual organization. While 
explaining to me how the MCP is laid out, one captain seemed to achieve the 
insight th!t N1 and SPD are thrust modes and that FLCH and ar * 

pitch modes. N1 and SPD are on the left of the speed select knob while FLCH 
and VNAV are to the right. Unfortunately, the conceptual organization of 
the MCP is at best local and inconsistent. Another pilot (B-737-300) told me 
that "this stuff up here (top row of buttons on MCP has to do with .this (the 
MCP). This stuff down here (bottom row of buttons) has to do with t s 

(FMS). " 


23 




IMMI 


Hutchins 


This desire on the part of pilots to read conceptual meaning into the 
spatial layout and the behavior of the MCP and other mode management 
displays and controls suggests a final design goal: to build an interface in 
which the physical layout and behavior of the displays and controls maps 
easily onto the underlying conceptual regularities of the autoflight system. 
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4. A conceptual analysis of autoflight modes 

If the analysis presented above is correct, then making the concepts that 
underlie autoflight operations more explicit in the behavior of the interface 
may improve operability and the rate and quality of learning. What are the 
underlying conceptual regularities and conceptual distinctions? Some of 
these come from the realm of flight in general (e.g. the distinction between 
pitching to a speed and pitching to a path) and some are specific to automated 
airplanes (e.g. is the performance target set by the crew or computed by the 
flight management computer system.) 

4.1. Methods for discovering the conceptual basis. 

Over the years cognitive anthropology has developed several methods 
for discovering conceptual structures. First and foremost among these 
methods is participant observation in which the researcher participates in the 
normal activities of the people and thereby learns to speak and act like the 
people do (Agar, 1980, 1986). Engaging in appropriate talk and action requires 
at least partial mastery of the conceptual structures that the natives use to 
organize their own behavior. Over the past 7 years, I have become a pilot. I 
now hold a commercial pilot's license with multi-engine and instrument 
ratings. This, of course, does not mean that I can claim to know the 
conceptual structures on the basis of introspection, but it has permitted me to 
engage real line pilots in meaningful discussions concerning the problems 
they face. I have conducted dozens of interviews with pilots, both in the 
cockpit and out. Analysis of discourse and interviews is a second major 
technique of cognitive anthropology (Hutchins, 1980, Holland and Quinn, 
1984; D' Andrade, 1995). 

To construct a knowledge of autoflight systems in state of the art 
aircraft, I have completed the ground schools for the Boeing 747-400 and the 
Airbus A-320. These ground schools do not qualify me to fly these airplanes, 
but they do permit me to observe pilots in flight in a different way. Before I 
took the training, I could see what pilots were doing. After the training, I 
could see not only what they were doing, but what they could have done but 
chose not to do. These courses enhanced my abilities as an observer. I have 
logged over 300 hours of jumpseat observations of line operations in 
domestic and international flights. These observations are the basis of the 
observed problems section of this paper. Participation in the training also 
gave me access to training materials, operational manuals, pilots, instructors, 
and, at Boeing, access to engineers who designed the systems. 

A third method for discovering conceptual structure is called 
componential analysis (Goodenough, 1957; Romney & D Andrade, 1961, 
Werner & Schoepfle, 1987). The goal of componential analysis is to isolate a 
set of underlying distinctions that can account for the system of meanings in a 
noun domain. In this case, the names of the autoflight modes constitute a 
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noun domain. A componential analysis of the mode names reveals the 
underlying conceptual distinctions that account for the differences in 
meaning among the mode names. A comparative componential analysis 
contrasting the underlying distinctions for the Boeing and Airbus mode 
naming conventions has been completed 8 . The major results of this analysis 
will be given below. 

4.2. Autoflight modes 

The following sections present the autoflight modes for the Boeing 747- 
400. This aircraft was the original target for the IMMI development. 


4.2.1. Roll Modes 

The roll modes for the 747-400 are given the following names: HDG 
SEL (heading select), HDG HOLD (heading hold), LNAV (lateral navigation), 
TOGA (takeoff and go-around), LOC (localizer) , ROLLOUT, and ATT 
(attitude). The conception of roll modes can be simplified considerably by 
noting that each mode is no more than a method for computing the 
directional target for the airplane. While there are seven roll modes, the 
modes fall into two major classes: modes in which the target is the heading 
of the airplane, and modes in which the target is *e ground track of the 
airplane. The heading based roll modes are HDG SEL and HDG HOLD. HDG 
SEL turns to the airplane to a selected heading and keeps it on that heading. 
HDG HOLD rolls the airplane's wings level and holds the heading that was 
achieved when the wings came level. 

Further distinctions among modes are made on the basis of the sources 
of track information. In LNAV mode, a ground track is computed by the 
flight management computer system, based on inputs to the MCDU. This 
ground track may be used to do the equivalent of VOR radial tracking, 
although it is the ground track defined by the radial, rather than the VO 
signal that is being tracked. LOC and ROLLOUT modes track the localizer 
signal of an instrument landing system approach facility. TOGA uses the on- 
board inertial navigation system to determine the ground track of the 
airplane at the onset of TOGA guided flight and uses that ground track as the 

target. 

Ground track can thus be defined by geographic coordinates (LNAV), by 
signals from ground based navigation aids (LOC and ROLLOUT), or by a 
momentary sensation of the inertial reference system (TOGA). 


8 The details of this method and its results will be reported in detail 


elsewhere. 
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The one remaining roll mode, ATT (attitude) is an infrequently used 
reversion mode. It engages only when a flight director is turned on m flight 
after a period in which neither flight director and none of the autopilots have 
been engaged and the bank angle exceeds 5°. Its main function is to provide a 
flight director guidance mode that keeps doing what ever the airplane was 
doing before the flight director was turned on. 


4.2.2. Pitch Modes 

The pitch modes are: TO/GA (takeoff and go-around), ALT (altitude), 
V/S (vertical speed), VNAV PTH (path), VNAV SPD (speed), VNAV ALT 
(altitude), G/S (glide slope), FLARE, and FLCH SPD (flight level change, 

speed). 


4.2.3. Autothrottle Modes 

The autothrottle modes are: THR-REF, THR, HOLD, IDLE, and SPD. 

These come in two flavors: speed modes and thrust modes. 

4.3. Mode Interactions 

Fortunately, the Roll modes are essentially independent of the Pitch 
and Autothrottle modes. The exceptions are that the toga and rollout roll 
modes only occur with certain pitch and autothrottle modes. Unfortunately, 
this independence is conceptually masked by the fact that the flight mode 
annunciator formats of both Boeing and Douglas aircraft display roll mode 
between the pitch and autothrottle mode displays. This is probably an 
attempt to maintain consistency with the layout of the primary flight displays 
in which the ADI and the HI (primary roll instruments) lie between the ASI 
(thrust instrument in level flight) and the Altimeter (a pitch instrument in 
level flight). 

Treating roll modes independently and knowing that there are few 
interactions between roll modes and other modes simplifies the mode 
management problem considerably. 

There are, however, significant interactions between pitch and 
autothrottle modes, and it is here that most of the conceptual problems seem 
to arise. Segregating the modes into classes and showing a simple set of 
relations among the classes may help to simplify the conceptual space. 

The rule is that whenever the pitch mode is controlling to a speed 
target, the autothrottle mode will be controlling to a thrust target. Whenever 
the pitch mode is controlling to a path target, the autothrottle mode will be 
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controlling to a speed target 9 . Figure 3 shows the interactions between the 
pitch modes and autothrottle modes. 


4.3.1. What every pilot knows 


PATH 

I 

O 

H 

0 . 

SPEED 


THRUST SPEED 


ND 

YES 

YES 

ND 


AUTOTHROTTLE 

Figure 3. The general rule of interaction between pitch and 
autothrottle modes. 

This should make sense to all instrument rated pilots, since it reflects 
the changes in the primacy of instruments in standard maneuvers. That is, 
in a normal climb, thrust is set, and speed is controlled by pitch. If the 
airspeed is too high, raise the nose; if the airspeed is low, lower the nose. 
When approaching cruise altitude, the nose is pushed down and the airplane 
accelerates to cruise speed. Pitch is now controlling flight path and thrust 1S 
controlling speed, which will increase if thrust is not reduced. A similar 
transition occurs at top of descent where thrust is typically brought to flight 
idle (or other descent value), and speed is controlled by pitch. 


4.3.2. 747-400 vertical mode interactions 

Note that speed should always by controlled by a pitch mode or an 
autothrottle mode. 10 * * This regularity considerably reduces the complexity of 


9 One exception exists. On an autoland, the pitch mode FLARE engages at 

about 50' AGL and tine autothrottle mode IDLE engages at about 25' AGL. For 

that last 25' of descent, speed bleeds off and neither pitch nor thrust controls to 

a speed target. 
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the space of mode combinations. Figure 4 shows the space of possible 
combinations of pitch and autothrottle modes. In this table, the distinctions 
among modes are made on the basis of the mode type (pitch or autothrottle), 
the controlled parameter (speed or path for pitch modes, speed or thrust or 
autothrottle modes), and the source of the target (Mode Control Panel, Flight 
Management Computer, or Ground Signal). 


10 There is a hidden danger here. It is possible to fly a visual approach in the 
747-400 with the autopilot, flight directors, and autothrottles off. If a go 
around is required, pushing the go-around buttons will provide go around thrust. 
The upward pitching moment caused by the below -wing mounting of the engines 
can feel like the TOGA pitch mode acting through the autopilot, even though 
the autopilot and pitch modes have not engaged. In this case, the autothrottle 
mode controls thrust, but only pilot action with the control column can control 
speed. It is possible for a distracted pilot in such a situation to inadvertently 
approach a stall condition. 
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Figure 4. The logically possible mode combinations. 

Figure 5 shows the space of actually occurring mode combinations, the cross 
hatched area indicates combinations that do not occur. 
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In training a lot of emphasis is placed on monitoring and calling out 
mode transitions whether they are crew selected or automatic. The purpose 
of making mode transition callouts must be to bring the conceptual 
implications of the current mode to the attention of the pilots. These 
conceptual implications concern what is being controlled and how. This is 
precisely what the figures above attempt to capture. Unfortunately, these 
relationships do not appear explicitly anywhere in the training materials. 

One reason that crews in training have so much trouble learning to attend to 
and call out mode transitions is that such callouts are only perceived as useful 
to the extent they bring to mind operational implications. When crew 
members are unclear on the meanings of the modes, they have little 
motivation to note mode transitions. 

What can be done about the seemingly arbitrary rules governing the 
availability of modes? 

In the automatic flight section of the 747-400 airplane operations 
manual the description of the speed switch on the mode control panel states 
that the speed switch is "inactive if in FLCH, VNAV, or TOGA" (07.10.2A). 

A pilot in training may choose to memorize this bit of information. If he 
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does not, he is at risk (as reported in section 3.3.9 above) of pushing this 
button while on one of these modes and finding that it does not respond. 
"What's going on?", he might ask. "Why can't I get speed mode? 

The answer is difficult to see in the current system for two reasons, one 
having to do with the design of the mode control panel, the other having to 
do with the training. The answer to the question is that the speed switch 
engages an autothrottle speed mode. FLCH, TO/GA, and VNAV-SPD (pitch 
modes) are speed controlling modes. Speed is already being controlled by 
pitch in these modes, so it cannot also be controlled by the autothrottle. All 
the VNAV modes include an automatic speed control function, so SPD mode 
is not appropriate. But this is hard to see because 1) the layout of the MCP 
provides only implicit hints that the speed switch controls an autothrottle 
mode rather than a pitch mode (after all, either sort of mode could control 
speed) and 2) the training does not make it clear that autothrottle and pitch 
modes have a mutually exclusive relationships with respect to the control o 
speed If these relationships had been made clear, it would be easy for a pilot 
reading the manual to know immediately why this switch will be inactive 
when the pitch mode is FLCH, VNAV, or TO/GA. The need to memorize 
the fact that SPD is inactive in these modes is eliminated. The behavior o 
the airplane autoflight system becomes meaningful rather than mysterious. 


In the description of the IAS/MACH selector, the pilot is told that 
when the IAS/MACH selector is pushed, the "IAS/MACH window does not 
blank if SPD, FLCH, or TO/GA mode is active" (07.10.02B). Again, to avoid 
surprises in flight, the pilot could either memorize these facts, or understand 
the reasons behind them. But the underlying conceptions are masked by the 
organization of the presentation of information. In this case, no effort as 
been made to distinguish the autothrottle mode, SPD, from the pitch modes, 
FLCH and TO/GA. If this had been done, it would be easy to see from the 
diagrams above that these three modes share in common the properties that 
they are modes that control the speed parameter on the basis of a speed target 
that is set on the MCP. The existing instruction and design of the flight deck 
give absolutely no explicit representations of the dimensions on which these 
three modes are members of a single conceptual category. If these 
dimensions were to be represented to the pilots, it would be obvious why the 
IAS /MACH window does not blank when the selector knob is pushed while 
these modes are engaged. These are just the modes in which a speed target is 
already being set on the MCP. A simple conceptual regularity replaces the 
need to memorize what otherwise seem to be unrelated facts. 


Similar problems exist in the relationship between the autothrottle 
mode engaged with the speed switch and the speed modes engaged by speed 
intervention" when the IAS/MACH selector is pushed. The former is 
exclusively an autothrottle mode. The latter is a "hidden" pitch mode. I say 
hidden because when speed intervention is selected on a descent, all the 
outward indications are that pitch is controlling path. However, "During 
descent, when speed intervention is used, the guidance mode essentially 
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changes to speed on elevator...." FCTM, p. 3-7. Path is no longer controlled by 
the pitch of the airplane. Deviations from path must be controlled with speed 
brakes or throttle. 

4.4. The conceptual distinctions for vertical navigation. 

The componential analysis reveals that the following dimensions and 
dimension values are required to make all the distinctions made in vertical 
modes for either of the mode naming schemes: 


Pitch target type: 

Thrust target type: 

Target source: 

Respect FMC constraints: 
Profile shape: 


speed, path, vertical speed, attitude 
idle, limit, speed 

MCP/FCU window, FMC, Nav aid. 
Autopilot 

Yes, No 

Airbus: Level, Up, Down. 

Boeing: Constant altitude. Changing 
Altitude 


Table 4.1. Conceptual distinctions needed to distinguish all modes in 
Boeing and Airbus mode naming schemes. 

Additional distinctions are needed to actually operate the system. 

These include: 

Autopilot engagement status: engaged, not engaged 

engaged, armed, selectable 

When there are two targets of the 
same type, which one will affect the 
flight path? e.g. when window alt and 
FMC alt targets disagree 


Mode status 
Target priority 


Table 4.2. Additional conceptual distinctions. 
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5. The current design 

An overview of the IMMI is shown in figure 6. The display consists of 
two main areas: a vertical mode manager at the top, and a lateral mode 
manager at the bottom. 



Figure 6. Overview of the IMMI display. Ready for takeoff. TOGA 
pitch and roll engaged, LNAV and VNAV armed. 

The lateral mode manager looks and behaves much like the current 
generation of lateral navigation displays. However, in accordance with the 
design goal to put the means of evaluating the current state of the system, 
making changes to the system, and assessing the consequences of changes all 
in the same location, the lateral mode manager has been enhanced to 
combine the earlier functions of route, data, and weather display with the 
new functions of mode annunciation and selection. The lateral mode 
manager hardware consists of a lateral situation indicator display and a 
heading select knob. Icons on the lateral mode manager show aircraft roll 
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guidance for heading and lateral path. Icon display state, color, and size 
indicate mode availability, and mode status (engaged, armed, selectable). 

Targets values are set by manipulating the hardware select knobs. The 
mappings of functions from the mode control panel of a Boeing 747-400 to the 
IMMI are shown in appendix 1. The appropriate mode icons appear according 
to the situation of the airplane and the settings of the select knobs. Modes are 
selected by touching the icons that represent the desired mode. A complete 
description of the controls and indicators on the IMMI display is given in 
appendix 2. 

The vertical mode manager is an all new display which combines 
altitude and speed tapes with a vertical situation display that depicts the 
vertical path of the airplane. Mode engagement status is depicted by the 
positioning, shape and color of graphical icons. Modes are armed and selected 
for engagement by touching the icon depicting a selectable mode. The vertical 
mode manager hardware consists of a vertical navigation display, a speed 
select knob, an altitude select knob, and a vertical speed select wheel. The 
vertical navigation display contains an airspeed tape, a vertical profile display, 
an altitude tape, four columns for the display of mode icons. Icons on the 
vertical mode manager show relationships of aircraft pitch and thrust to 
airspeed/mach and vertical flight path. Target source (FMCS or crew input) 
and target value are indicated by the location of the icon with respect to 
airspeed/mach and altitude tapes. 

Autoflight systems' state display and mode selection actions are co- 
located. In both mode managers, autoflight modes are depicted by icons on a 
conceptually meaningful graphical display rather than by strings of characters. 
Target values are set by manipulating hardware knobs. 

Although the IMMI includes an airspeed and altitude tapes, it is not 
intended as a primary flight instrument. Part of the mode management task 
is setting targets (speed and path) with respect to other targets, the current 
operating envelope limits, and the current operating parameters. These tapes 
are provided to make this possible. 

5.1. The lateral mode manager 

There were three related design goals relating to the lateral mode 
management. 

1. Make the distinctions among modes more perceptually salient and 
conceptually meaningful on the NAV display. 

2. Make the active waypoint perceptually more salient on the lateral 
navigation display. 

3. For all modes, the action taken to select or engage the mode should 
somehow bring the operator into contact with easy to process 
representations of the specific consequences of engaging that mode. 
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Figure 6 shows the IMMI display with the aircraft ready for takeoff. 

The active waypoint icon is the white circle in front of the airplane labeled 
SFOOl. It has been increased in size to make it perceptually more salient. It 
also always is shown in a color that contrasts with the magenta color of the 
FMC computed track line. The active waypoint icon is now a mode 
annunciator and mode selector. The color of the waypoint icon indicates the 
engagement status of the mode. In this case, the white color indicates that 
LNAV mode is armed for engagement. When the conditions for engagement 
are met (50' of radar altitude) the mode will automatically engage, and the 
icon will turn green. Figure 7 shows LNAV engaged with Porte the active 
waypoint. When LNAV is selectable, but neither armed or engaged, the icon 
appears blue (Figure 12, a&b). In order to engage or arm the mode, the pilot 
must find the active waypoint icon and touch it. This makes the spatial 
relationships between the airplane, it's current course, and the location of the 
active waypoint apparent to the pilot before the mode is engaged. This solves 
the "meta-button" problem observed in some engagements of LNAV mode 
in the current generation of aircraft. 



Figure 7. LNAV engaged, heading bug behind airplane and compass 
rose wrapped to keep heading bug visible. 
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A similar solution has been adopted for the heading select mode. The 
heading select mode is selected by touching the heading bug on the NAV 
display. Just as was the case for LNAV selection, this makes the spatial 
relationship between the airplane's current heading and the selected heading 
apparent to the pilot before mode engagement. For this to work in all 
conditions, the heading bug must always be visible on the NAV display. As 
the heading bug moves away from the nose of the airplane, the compass rose 
on the lateral navigation display expands to always include a wide enough arc 
to include the heading bug. Figure 7 shows the display with the heading bug 
nearly behind the airplane. This expansion and contraction of the compass 
rose satisfies another goal of having the display itself change to indicate that 
the heading bug is going behind the airplane. This additional bit of structure 
in the display's behavior provides the crew with an additional cue about the 
location of the heading bug. 

5.2. The vertical mode manager 

Our most general design goal was to build an interface in which the 
physical layout and behavior of the displays and controls maps easily onto the 
underlying conceptual regularities of the autoflight system. The table below 
shows the correspondence of conceptual distinctions underlying the 
operation of the vertical component of the autoflight system to perceptual 
distinctions in the interface. 

Conceptual distinction Perceptual distinction 

Target source: FMS/MCP Icon location: Between 

w tapes /Outboard of tapes 

Target type: Speed/Path Icon location: Adjacent speed tape/ 

Adjacent altitude tape 

Control axis: Pitch/Thrust Icon shape: Airplane /Engine 

Mode status: Icon color and fill: 

Engaged/ Armed/Selectable/Envelope Green(solid)/White(solid )/Blue 
limit (outline)/ Amber(solid) 

Path source: FMS/MCP Path line color: Magenta/ Green 

Table 5.1. Correspondence of conceptual distinctions to perceptual 
distinctions for vertical mode management. 

The vertical path display satisfies the design goals to provide a 
graphical representation of the future vertical trajectory of the airplane and to 
have a single representation in which all descriptions of flight path are 
displayed in such a way that it is easy to determine which will be controlling 
in any situation. Figure 8 (Climbing to an engaged altitude below cruise 
altitude. The solid green airplane icon on the inboard side of the speed tape 
shows that the airplane is climbing in a mode that uses pitch to attain an FMC 
specified economy speed target (VNAV-SPD). The solid green engine icon on 
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the inboard side of the altitude tape shows that the path of the airplane is 
controlled by a FMC specified level of engine thrust. The blue outline 
airplane icon outside the speed tape shows that a mode in which the airplane 
will pitch to an MCP specified speed (FLCH) is available for engagement. The 
blue outline airplane icon outside the altitude tape shows that a mode that 
will pitch to an MCP specified path (V-SPD) is also available for engagement. 
The green horizontal line at FL230 shows that unless a higher altitude is 
selected before reaching this altitude, the airplane will level off at this altitude 
even though the magenta FMC computed climb path continues up to the 
cruise altitude of FL330. 



Figure 8. Climbing to an engaged altitude target by pitching to FMC 
specified Econ speed target. 

The extent of the vertical path that is shown depends on the scale 
selected on the lateral navigation manager. The vertical path display shows 
the same path component as is shown on the lateral navigation manager. 
The enroute waypoints are shown along the bottom of the vertical path 
display. The "goal-posts" show altitude restrictions specified for the 
waypoints. This makes it easy to see if the airplane will meet or violate 
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altitude restrictions. If the autoflight system predicts that an altitude 
restriction will not be met, the goalpost will turn amber. 

All and only those modes that can be engaged or armed from the 
current operating mode are presented for selection. The display of icons is 
context sensitive so that icons for modes that are not selectable from the 
present context are not displayed. Thus, when the airplane levels off at an 
intermediate altitude in a climb, no pitch modes are selectable until a new 
altitude has been selected. Figure 9 shows the leveloff condition before the 
selection of a new target altitude. Figure 7 shows the leveloff after the 
selection of a new altitude target, and figure 8 shows the situation after a 
climb method has been selected. On the systems currently in use, all mode 
select switches are continuously present (as hardware) even though they may 
not be selectable. In the IMMI it is easy to see that no vertical modes other 
than the currently engaged modes are available for selection. 



Figure 9. Level at 10,000'. No other vertical mode icons will appear 
until a new altitude target has been set. 

Engaged, armed, and selectable modes and their performance targets 
(speed, path) are represented explicitly in the color and placement of the 
icons. When speed intervention has been selected in any VNAV mode, an 
icon indicating return to the FMC computed speed target appears as selectable 
This solves the problem of knowing how to restore the econ-speed target for 
VNAV from the speed intervention condition. 
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Impending uncommanded mode changes are indicated by the engaged 
icon turning from solid green to solid amber color before the mode transition. 
The most frequently encountered such uncommanded change in normal 
operations is the transition from VNAV-PTH descent to VNAV-SPD when 
maintaining the path would lead to an overspeed. Figure 10 shows the 
VNAV-PTH icon turning amber as the speed approaches Vmax. 



Figure 10. Impending uncommanded mode change for envelope 
protection. The VNAV-PTH icon turns amber to indicate impending change. 



Figure 11. After the uncommanded transition to VNAV-SPD descent. 
Notice that the pitch icon has moved from the altitude tape (path) to the 
speed tape. 

Figure 11 shows the state after the uncommanded change has taken 
place. Automatic/ conditional mode transitions are not explicitly represented, 
but it is always easy to see which mode is coming next. On the vertical path 
display, the automatic transition from any climb mode to altitude keeping 
mode is shown by the position of the green line. The transition from 
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localizer armed to engaged on the lateral mode manager (figure 12a and b), 
and the transition from glideslope armed to engaged on the vertical are also 
easy to anticipate. 



Figures 12a &b. The localizer is armed (12a) by touching the localizer 
icon. The localizer engages automatically upon localizer capture (12b) and the 
icon turns green. 

5.3. The airspeed tape 

The design goal of associating salient perceptual regularities in the 
display with the underlying conceptual regularities extends to the design of 
individual components of the displays. The airspeed tape presents an 
especially good example. The traditional round-dial airspeed indicator has 
some nice cognitive properties (Hutchins, 1995b). The mapping of the 
abstract quantity speed onto a fixed extent of space permits pilots to use fast, 
robust perceptual processes to do conceptual tasks. Speed bugs partition the 
space of speeds into meaningful regions. One of the most important 
properties of the airspeed indicator is that its gross physical appearance 
changes with speed. This is not true of the current generation of "glass" 
airspeed instruments. On these, the gross physical appearance of the display 
is the same at all speeds. Pilots often complain that they must read the 
number in the box in order to determine their speed. Some have advocated 
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giving up on airspeed tapes ^ . The problem does not lie in the technology, 
but in the way it is used. It is possible to build a "glass" tape that has the 
cognitive properties found in the round-dial instruments. The speed tape in 
the IMMI is an example. The airspeed tape on the IMMI always displays the 
entire current operating speed envelope for the airplane. Stall speed is at the 
bottom of the tape and Vmo or Mmo is at the top. This speed range is 
sensitive to airplane configuration and atmospheric conditions. Contrast this 
to the current practice in the 747-400, the A-320, and the MD-11 of showing a 
constant 120 knot window around present airspeed. 



Figures 13a &b. The airspeed tape showing a slow speed during 
approach (13a), and a fast speed in descent (13b). 


11 Lovesey, 1992. claims that "tape displays have been introduced into 
cockpits at regular intervals (for example: 1925, 1938, 1960s, 1970s). Each time 
they are introduced, they are soon found to be inferior to round dials and are 
rejected. " 
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While the present airspeed always appears in the center of the tape in 
the current generation tapes, on the IMMI airspeed tape, the present airspeed 
box moves to the position on the tape corresponding to the present speed. 

This means that when the airplane is operating in the slow end of its current 
operating envelope, for example, the airspeed box will be at the bottom of the 
tape. This movement of the box is a perceptually salient cue for airspeed. It 
permits pilots to judge the speed of the aircraft in functional terms of fast and 
slow even with the instrument in peripheral vision. Figure 13a and b show 
the airspeed tape indicating a low speed on approach and a near overspeed 
condition in descent, respectively. Notice that the range of the airspeed scale 
depends on the airplane configuration and the atmospheric conditions. 

5.4. Conceptual validation: 

To ensure that the IMMI could represent all autoflight related actions 
and display changes we conducted a careful analysis of a simulated flight. We 
identified 102 autoflight related representations and actions in the simulated 
flight from PHX-LAX. For each event, we mapped out the corresponding 
IMMI action or display state. 

5.5 New problems introduced by the design. 

A small number of new problems are introduced by the IMMI design. 
These became most apparent when the IMMI was installed in the Advanced 
Concepts Flight Simulator of the CVSRF at NASA Ames. All proposed new 
instruments face the problem of cockpit real estate. Where can the device be 
placed in the already crowded cockpit. The design of the ACFS includes 5 
display screens arrayed in a row across the instrument panel. The IMMI was 
installed on the center screen. The hardware knobs used to set target values 
were installed around the perimeter of the center display screen. 

A potentially more serious problem arises from the requirement to 
have a touch-screen interface. While it is possible to use touch screens in 
aircraft, the designs are limited by two factors. First, the technology of touch 
screens is such that there appears to be just enough resolution in the current 
generation of technology to allow the discrimination of adjacent icons in the 
display. It is expecte(d that this limitation will be relaxed as the technology 
matures. A second limitation concerns the pointing accuracy of an operator, 
especially when the airplane may be bouncing in turbulence. The touch 
accuracy at arm's length in bumpy conditions is not good, and there is some 
concern that a touch interface would become unreliable in turbulence. It is 
not known how serious, this problem might actually be. By placing other 
fingers on the display frame, it is possible to improve touch accuracy 
considerably, even in bumpy conditions. 


V 
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6. Evaluation 

The plan for the evaluation of the IMMI has three parts. First, a 
comparative cognitive walkthrough for the 747-400 and the IMMI was 
performed. Appendix 3 shows sample pages from the analysis. This analysis 
led to the production of a set of predictions about the effects of replacing the 
current interface with an IMMI. Second, the IMMI was installed in the 
Advanced Concepts Flight Simulator of the CVSRF at NASA Ames research 
center. This required a large software engineering effort because the variables 
used by the simulators in the CVSRF are poorly documented and because the 
IMMI needed to interface with proprietary code supplied to CVSRF by 
airframe manufacturers. Third, a simulated flight scenario was designed to 
test the effects of the IMMI compared with the 747-400. Preliminary testing of 
the IMMI in the designed scenario was commenced in the summer of 1995. A 
comparative study was planned using 747-400 line pilots flying the scenario in 
both simulators at the CVSRF. The simulators were taken off-line in the fall 
of 1995, and unfortunately, the grant ended before the simulators became 
available again. 

6.1. IMMI predictions 

It is possible to make some predictions regarding the elimination or 
reduction of operational errors and the reduction of training time. Here are 
five different kinds of predictions about the IMMI. 

1. Some errors that have been observed with the current system will be 
entirely eliminated because they are made impossible by the new design. For 
example, it is not possible with the IMMI to attempt to select a mode that is 
not available from the current state of the system. The suppression of icons 
depicting modes that cannot be selected in the current context should simplify 
the decision rules pilots employ in operating the autoflight system and 
should eliminate the now common instances of failed attempts to engage 
modes that are not available. This may be operationally important, but it is 
not interesting from a theoretical point of view because the prediction does 
not make much use of the theory. Perhaps a more interesting case is that one 
cannot choose heading select mode without being aware of the current 
location of the heading bug. This leads to the prediction that the error of 
entering heading select mode while the heading bug is behind the airplane 
(producing an undesired turn) will be eliminated. 

Note the role of observations of current practices as a baseline against 
which we characterize the performance on the new interface. 

2. Other classes of error are also expected to occur less frequently. The 
unexpected leveloff (e.g. in the Peble 1 departure described in section 3 above) 
and other vertical awareness problems should be remedied by the presence of 
the vertical path display. Conflicts between performance targets set by crew 
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and FMCS are explicitly depicted in the graphics of the vertical profile display. 
This should reduce the frequency of errors due to the autoflight system 
tracking a target that the crew is not attending to. This is a bit more interesting 
from the theoretical perspective than the suppression of unselectable modes, 
but not very much. In this case the presence of representations of the right 
kind makes the construction of a situation model easier for the pilot. The 
consequence of the actions are easy to see as long as one can interpret the 
graphical notation. 

3. The frequency of unexpected steep turns to the active waypoint 
when rejoining a LNAV route should decrease. This is because the IMMI 
requires the pilot to know the position of the active waypoint relative to the 
airplane before engaging LNAV mode. Putting meaningful content in the 
action that engages the mode should help fix this problem. 

This is the embodiment of a general principle. In the current system 
the internal structure of the actions that select modes have only arbitrary 
relations to the consequences of mode selection. In the IMMI, the content of 
the consequences is built into the selection action. For example, touch the 
active waypoint to engage LNAV or touch the heading bug to engage heading 
select. 

4. The situation with vertical modes is more complex and more 
interesting. With the vertical modes the IMMI employs a theoretical 
principle that the underlying conceptual regularities in the behavior of the 
system should be reflected in the behavior of the interface itself. This goes 
back to the Hutchins, Hollan, and Norman (1986) work on direct 
manipulation interfaces. The basic notion is that the user must create a 
bridge from the structure of a representation to its meaning. We can make it 
easy for the user to construct this bridge by providing structure in the 
representation that can be seen as similar to the conceptual structure of the 
thing the representation refers to. 

In the IMMI, the conceptually meaningful representation of modes 
mirrors the underlying regularities of the autoflight system. This should 
reduce the apparent complexity of the autoflight system, thereby promoting 
safer, more efficient use of the autoflight system. It should also reduce the 
amount of training required to prepare pilots to fly the airplane, and improve 
the quality of actual flight experience as a context for learning. This 
representation also permits flight crews to link perceptual routines for 
parsing the display to the underlying conceptual regularities. 

This problem exists at all levels of organization of the system. Thus 
the static shapes of the icons should suggest the things they are intended to 
represent. But also, the behaviors of the icons should suggest the behaviors 
of the things they represent. The IMMI uses space and color to encode 
conceptual features of autoflight that are masked in the current interface. For 
example, icons depicting FMC targets are inside the tapes - adjacent to the 
FMC computed path. Icons depicting pilot specified targets are outside the 
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tapes. The icons are of only two types: pitch and thrust (distinguished by 
meaningful shapes) and they are associated with only two kinds of targets 

(speed and vertical path). The association of performance target with a 

control axis is indicated by the spatial adjacency of the icon(control axis) with 
one tape or another (performance target). 

The prediction from this is that it will be easier for pilots to 1) see and 
understand what the system is doing. 2) operate the system, 3) learn to use the 

system. 

5, Another class of predictions concerns the distribution of places 
where pilots must attend. MCP, FMA, MCDU, PFD in order to do the job. Co- 
location of mode state depiction and mode selection apparatus provides for 
the composition, execution and evaluation of mode management actions all 
in the same place. This should reduce the frequency of mode selection errors 
due to crew failure to note flight mode annunciator changes. See (Palmer, 
1994) for a case in which an altitude capture was killed by a mode selection in 
a recently changed mode configuration. 

All of these predictions have the character of noticing a problem in the 
current interface, characterizing the situations in terms of a cognitive theory 
(is it a memory problem, a reasoning problem, an activation error, etc.) and 
then exploring design alternatives that, when characterized in terns of the 
theory, do not generate the earlier observed errors. 

6.2. Flight test scenario 

A simulated flight from SFO to LAX was designed to test the IMMI. 

The simulated flight includes operational contexts which have been observed 
in line operations to lead to various classes of mode management problems. 
The ATC script for the scenario is shown in Appendix 4. A description of the 
flight, the interventions, and the expected consequences in terms of mode 
management are given in Appendix 5. 
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7. Conclusions 

The Integrated Mode Management Interface is a graphical user 
interface to the autoflight mode management functions of state-of-the-art 
airline cockpits. It is based on the design principle that the perceptual 
distinctions available in the appearance and behavior of the interface itself 
should mirror the conceptual distinctions made in the structure and function 
of the underlying autoflight system. 

More work could surely be done on the design of the icons and the 
graphics. It may well be that pilots would prefer a different sort of icon set to 
represent the distinction between pitch and thrust modes, for example. The 
current design also seems visually busy. A cleaner, simpler design with a 
lower spatial frequency would probably be an improvement. It may even be 
the case that a different conceptual model would better capture the 
underlying distinctions that pilots need to make to reason about and control 
the autoflight system. Captain Jim Irving has suggested that the display 
should also represent the energy situation of the airplane 12 . This would be 
especially important in an airplane like the High Speed Civil Transport. 

Whatever the refinements that are made, I am confident that the 
principle of building an interface that provides a perceptual basis for 
conceptual process is correct. The EMMI is an attempt to explore the uses of 
that principle in the domain of autoflight mode management. 
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Aircraft (through the help of William Corwin) allowed me to attend MD-80 
ground school. I am grateful to American West Airlines (especially, Beth 
Lyall) for the full A-320 ground school. 
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Top Panel - Vertical display 

a. Speed Tape. 

Displays the appropriate range of speeds for the flight's current operation 
envelope. (As determined by weight and altitude.) 

b. Vertical profile display. 

Displays the vertical component of the FMC entered route. Also displays 
manual adjustments and overrides. 

c. Altitude Tape. 

Always displays the complete range of altitudes for the direction of cruise. 
Includes a sliding virtual window that covers half of the tape in order to 
provide greater resolution for the 10000 feet surrounding the current 
altitude. See w for a more complete description. 

d. Icon Column for manual speed changes. 

All icons for manually adjusted speeds will appear in this column. 

e. Icon Column for FMC speed changes. 

All icons for either FMC controlled speeds, or FMC speed editing, will 
appear in this column. 

f. Icon Column for FMC altitude changes. 

All icons for FMC controlled altitudes will appear in this column. In 

general, all thrust-to target altitudes will be here, since the FMC controls 
thrust. (But there are exceptions, such as altitude capture or VNAV- 
PATH.) Pitch-to targets which are FMC entered altitude restrictions will 
also be here, even if a different window altitude target exists. Once the 
altitude target in the altitude window is captured however it will appear 
in the outside column, g. (see below). 

g. Icon Column for manual altitude changes. 

All icons for manually commanded altitudes will appear in this column, 
when captured. Since most altitude targets in the altitude window, 
although manually selected, are achieved via the FMC, their icons 
appear on the inside of the tape. At capture however their manual 
selection is recognized. Vertical speed icons will always go in this 
column, since they are completely manually determined. Thrust-to 
icons for A/T HOLD in either TO roll or descent will also go here, since 
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they indicate that if the pilot manually adjust the throttles the throttles 
will remain in place at the manual adjustment. 

h. Pitch to target icon. 

Engaged icons should be LARGER than armed or selectable icons. 

Color: white Condition: armed. 

This means that the icon is controlled by some other action, usually via the 
FMC. When the appropriate conditions are met the icon will 
automatically engage. 

Color: blue Condition: selectable 

This means that the icon represents an option that can be chosen. Touching 
the icon will engage that option if the conditions for engagement are met 
(which will usually be the case). Otherwise the icon will go to armed. 

(EX. localizer, G/S icons which appear on the lateral and vertical 
displays respectively.) 

Color: green Condition: engaged 

This means that this represents what is currently providing command 
guidance. 

Shown are a selectable pitch-to-manual speed in the far left column, a 
selectable FMC computed pitch-to-ECON speed in the next column and 
an engaged pitch-to-path for the captured altitude in the far right 
column. 

i. Thrust to target icon. 

Engaged icons should be LARGER than armed or selectable icons. Note 
definitions of the conditions are the same as in h. above. 

Color: white Condition: armed. 

Color: blue Condition: selectable 

Color: green Condition: engaged 

Shown are an engaged thrust-to-speed, selected by speed intervention in the 
inside left column and an armed thrust-to-path/ altitude in the inside 
right column. 

j. Manual speed window. 

Color: blue Condition: selectable 

This shows the current speed of the aircraft and is associated with the pitch- 
to-speed icon in the manual column. The selectability is actually of the 
associated icon. 
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Color: green Condition: engaged. 

Once the appropriate manual icon is selected that icon and this window 
changes to green to show that this is the engaged option. 

k. FMC edited speed window. 

Color: magenta. 

The value in this window is always magenta so that it is clear that this is a 
target that edits the speed in the FMC. The airplane will follow the 
magenta path on the vertical profile display at the specified speed if 
possible. 

l. Altitude window 

Always displays the manually set altitude target, usually the last ATC 
cleared altitude. 

Color: green. Condition: engaged. 

This means that this is the current altitude target being flown to. It is also 
represented on the vertical display by a green line, n. 

Color: blue Condition: selectable 

Moving the knob changes the value in the altitude window and moves a 
line on the vertical display which represents the new altitude target. 

This line, m., and the number in the window, are both blue. This 
corresponds to a selectable pitch icon representing choices of how to 
meet that altitude target. When the desired icon is selected then the 
icon, the new altitude target in the altitude window, and it’s associated 
line all turn green. 

m. New altitude target. 

Color: blue Condition: selectable 

Color: green. Condition: engaged. 

When a new altitude target is selected, if the previous altitude is captured, 
then a dashed blue line appears on the vertical display. As the altitude 
knob is adjusted, changing the number in the altitude window, this line 
moves to the appropriate spot on the display. The new altitude is 
engaged by touching the appropriate icon corresponding to the desired 
method of reaching the target altitude. Engaging the icon will change 
the line to green for engaged. The line for a previously captured altitude 
will disappear. 
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n. Captured altitude or engaged altitude target. 

Color: green Condition: engaged. 

See m. 

o. Current FMC route - vertical component. 

Color: magenta. 

Shows the vertical portion of the active route entered in the FMC that the 
auto pilot will fly if A/P engaged and VNAV is the active mode. In this 
case the start of the path in front of the nose of the aircraft indicates the 
top-of-descent. 

p. Alternate path 

Color: blue. Condition: selectable 

Color: green Condition: engaged. 

Shows the vertical portion of the manual choice for ascent or descent to a 
different altitude when at a captured altitude, IF that path will be 
different from the FMC computed path. In this case the diagram 
assumes that the descent path associated with the manual pitch-to-speed 
icon is different than the FMC computed path. Note that paths 
associated with manual speed targets circumvent the FMC path and 
therefore any FMC known altitude restrictions. 

If the manual pitch-to-speed icon is selected and engaged then this path will 
change to green. The FMC computed path will remain in magenta on 
the display. 

Note: behavior of lines representing paths and altitudes 

Magenta paths are always FMC controlled and solid lines. 

Captured altitudes are represented by solid green lines. Engaged altitude 
targets that have not been reached are represented by dashed green lines. 
If this altitude target will cause the aircraft to level off then the portion of 
the line that continues from the path will be solid. Eg. on the diagram if 
line m became the engaged altitude target then the portion of m near the 
letter p would change to a solid line. 

Alternate paths, other than FMC computed paths are solid lines shown in 
blue when selectable and green when engaged. 

q. Crossing restriction. 

Color: magenta. Condition: engaged. 

Color: amber. Condition: warning. 
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Direction of arrow indicates "cross at or above" versus "cross at or below". If 
no arrow then it is a "cross at" restriction. Indicated in magenta to show 
a part of the FMC route. If one changes to amber it is a warning that the 
current performance of the aircraft may not meet that restriction. The 
first restriction that may affect the FMC path will have a horizontal 
dashed magenta line lining up with the altitude tape. For example, the 
FMC path shown here will easily make both restrictions at CZI, but the 
restriction to cross ROCKY @ 10000 will force the aircraft to level out, so 
there is a dashed magenta line. 

r. active waypoint. 

Color: green Condition: engaged. 

Color: white Condition: armed. 

Color: blue Condition: selectable. 

Corresponds to the active waypoint on the lateral display. Green and 
engaged refers to the engagement of LNAV. If LNAV is not engaged 
because HDG-SEL is engaged, then the active waypoint is blue. If LNAV 
is not engaged because LNAV is armed before TO, but not engaged then 
the active waypoint is white. 

Note: Waypoint identifiers are shown below the line delimiting the vertical 
display. Waypoint identifiers are assumed to be either 3-letter VOR 
identifiers, 5-letter intersection names, lat-long designators or fix/radial 
distances (eg. BLH275/075 where BLH is the VOR, 275 is the radial and 
075 is the DME distance). 

s. inactive waypoint(s) 

Color: magenta. . 

Corresponds to the inactive waypoint(s) showing on the lateral display. 
Regardless of whether LNAV is or is not engaged the inactive waypoints 
will always show in magenta. 

Note: route mismatches on approach 

Color: amber. Condition: warning. 

If during approach a route in the FMC does not match the displayed glide 
slope (G/S) for the runway then the waypoint identifiers will appear in 
amber as a warning that the displayed waypoints and their restrictions 
are not for the G/S displayed. 
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t. Speed knob. 

To manually adjust speed. 

If the aircraft has captured an altitude and a new altitude target is selected, 
then the current speed will appear in the manual speed window and an 
associated pitch-to-speed icon will appear in the far left icon column. In 
this case moving the knob will adjust the speed, as well as moving the 
appropriate icon in the manual column. 

If the aircraft has captured an altitude, but no new altitude target is selected, 
then touching the speed knob will cause the current speed to appear in 
blue in the manual speed window. An associated pitch-to-speed icon 
will appear in the far left icon column. Moving will then change the 
speed that appears in that window, as well as moving the appropriate 
icon in the manual column. 

Pushing the knob is required for speed intervention. This will cause the 
current speed to appear in magenta in the FMC speed editing window. 

An associated pitch-to-speed icon will appear in the FMC speed icon 
column. Moving will then change the speed that appears in that 
window, as well as moving the appropriate icon in the FMC column. 

u. Altitude knob. 

The altitude knob is used to manually adjust the altitude target. The current 
altitude target always appears until a new altitude target is entered. This 
knob changes the value in the window, as well as moves the appropriate 
icon in the FMC or manual column, and the altitude target line on the 
vertical profile display. 

v. Vertical speed wheel 

Touching this wheel causes a pitch-to-path icon to appear in the manual 
altitude icon column at the current rate of vertical change. Note: here, at 
level flight the appropriate icon would show 0 for no rate of vertical 
change. 

Moving the wheel will change the rate of descent or ascent. The icon will 
appear next to the altitude target and the value of vertical rate will alter 
inside the icon as the wheel is moved. 

w. Altitude resolution window 

The nearest 10000 feet to the aircraft are displayed at a higher resolution 
than the rest of the altitudes. This virtual window moves with the 
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aircraft. In the scenarios the window is shifted when the aircraft is in the 
middle of the range. Ideally in implementation the window shifts 
continuously. 

During approach the resolution shifts from a tick mark every 1000 feet to a 
tick mark every 500 feet. 

x. Aircraft 

Color: white. Position on the vertical display indicates the aircraft altitude. 

y. Glide Slope 

NOT SHOWN- 

Glide slope (G/S) symbol as shown on approach plates. When the runway is 
entered in the FMC the G/S symbol will appear on the appropriate place 
on the route in blue to show that it is selectable. 

When touched, the blue icon changes to white to show that the G/S is 
armed for capture. When the G/S signal is captured the icon 
automatically changes to green to show engaged. When engaged this 
signal controls the vertical guidance of the aircraft, so horizontal lines 
associated with altitude targets disappear from the display. Note: at G/S 
capture the altitude window can be reset to show the missed approach 
altitude. 

Bottom Panel - Lateral display 

a. Heading bug knob. 

Moving the knob moves the position of the heading bug in the direction of 
movement. 

b. Aircraft indicator. 

Color: white. Indicates the aircraft position and direction of flight. 

c. FMC route. 

Color: white Condition: armed. 

Color: magenta. Condition: engaged. 

Shows the active route entered in the FMC that the auto pilot will fly if A /P 
is engaged and LNAV is the engaged roll mode. Waypoints other than 
the active one are in the same color as the route. The extent of the 
laterally displayed route corresponds to the extent of the vertically 
displayed route. 
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d. Active waypoint. 

Color: white Condition: armed. 

Color: green. Condition: engaged. 

Color: blue Condition: selectable 

Shows the immediate target waypoint for the FMC. Distinctions between 
armed, selectable, and engaged correspond to that described for the 
vertical display. 

e. Heading bug line. 

Color: white, green 

Dashed line that extends from the nose of the aircraft indicator to the 
current position of the heading bug. 

If the heading bug is selected then this line will change to green. 

f. Heading bug . 

Color: blue Condition: selectable 

Color: green. Condition: engaged. 

When green the heading bug indicates in HDG-SEL mode. Changing the 
bug position will result in changes in aircraft position. 

When blue the heading bug shows that HDG-SEL is available and selectable. 
In this mode moving the heading bug does not alter the aircraft's course. 

g. Current heading/track indicator. 

Color: white. 

Always indicates the current heading or ground track being flown. Which 
one is determined by the display mode the lateral display is in. 

h. Compass rose 

Color: white 

Note: this rose is not an accurate 180 degrees. Rose can be displayed in any 
of the legitimate display modes for the lateral display. 

i. Ground track indicator. 

NOT SHOWN- 

Straight green line with arrow at the end where meets the compass rose. 

Color: green Appears only during takeoff to indicate the ground track 
aircraft is flying for roll guidance during TOGA mode. 

j. Localizer 

NOT SHOWN- 
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Localizer symbol as shown on approach plates. When the runway is 

entered in the FMC the localizer symbol will appear on the appropriate 
place on the route in blue to show that it is selectable. 

When touched, the blue icon changes to white to show that the localizer is 
armed for capture. When the localizer signal is captured the icon 
automatically changes to green to show engaged. When engaged this 
signal control the lateral guidance of the aircraft so if the aircraft was 
previously in heading select it is not any longer. Note: at localizer 
capture the heading bug automatically resets to the localizer inbound 
course. 

HARDWARE 

Duplicates the necessary hardware switches. 

a. Flight Director toggle switch 

Up is the on position, down is the off position. These switches must be 
manually flipped on in order to provide FMC generated flight director 
information to the primary flight displays. 

b. Auto Throttle toggle switch 

Up is the on position, down is the off position. When manually flipped this 
turns the auto- throttles (A/T) on and off. A/T can also be disconnected 
from buttons on the throttles themselves. When disconnected the 
toggle-switch should reset to the off position. 

c. Auto Pilot Push buttons. 

Pushing these buttons engages the auto pilot (A/P). Each button represents 
one of three available A/Ps. Usually the aircraft is flown with the Center 
(C) A/P engaged. Engaging the A/P means that the FMC computed 
commands are being directed to control surfaces to fly the aircraft, 
depending on the engaged modes. When an autopilot is engaged the 
button will change to green. 
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Notes: 

1 . HDG SEL is always available 

2. Location of icon is meaningful. Action of selecting HDG-SEL mode 
brings pilot into contact with the lateral display. 

Outcome: AFDS provides guidence to follow target heading 
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IMMI System 

Mode: HDG Select Goal: Turn aircraft to a target heading and maintain target heading 
Representation: Target heading bug on the lateral display 

Interpretation 

Mode State of System State Available Actions Source AFDS Constraints 



FMA - green LNAV 

Previous mode 
is disengaged 

Outcome: AFDS provides guidence for airplane to follow programmed route. 
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Mode: LNAV Goal: Follow programmed route along lateral (N-S-E-W) headings 

Representation Waypoint and label on lateral display 

Interpretation of 

Mode State System State Available Actions Source AFDS Constraints 
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IMMI System 

Mode: Localizer Goal: Find and track the localizer 
Representation: Localizer icon on lateral display (at right scale?) 

Interpretation 

Mode State of System State Available Actions Source AFDS Constraints 
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Disarm Localizer icon turns blue Touch white icon Pilot Disarms mode 




Outcome: AFDS provides guidance to airplane to follow ground track in flight. 
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IMMI System 

Mode: TOGA/Roll Goal: Maintain ground track in flight 

Representation: Arrow on lateral display 

Interpretation of 

Mode State System State Available Actions Source AFDS Constraints 
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IMMI System 

Mode: HDG Hold Goal: Maintain heading aircraft is on after wings are rolled level 

Representation (a) Button on Heading selector, and (b) two handed HDG Hold icon holding airplane symbol 

Interpretation 

Mode State of System State Available Actions Source AFDS Constraints 




Outcome: AFDS provides guidence for airplane to maintain current attitude 
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IMMI System 

Mode: Attitude Goal: Maintain airplane's current roll attitude 

Representation: Attitude Icon 

Interpretation of 

Mode State System State Available Actions Source AFDS Constraints 



Outcome: AFDS provides guidence so airplane lands on centerline. Passengers clap. Crew welcomes 

passengers to beautiful San Diego. 
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IMMI System 

Mode: Rollout Goal: Maintain airplane on runway centerline till touchdown 

Representation: Rollout icon appears on lateral display (heavy white line in front of airplane) 

Interpretation of 

Mode State System State Available Actions Source AFDS Constraints 



1 . HDG SEL is always available 

2. In any mode, at LOC capture HDG bug will go to inbound course for 
runway. 

Outcome: AFDS provides guidence to follow target heading 
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747-400 System 

Mode: HDG Select Goal: Turn aircraft to a target heading and maintain target heading 
Representation: Target heading bug on the lateral display (LNAV, TOC, LOC) (??? mike 1/6/94) 

Interpretation 

Mode State of System State Available Actions Source AFDS Constraints 



Previous mode 
is disengaged 

Outcome: AFDS provides guidence for airplane to follow programmed route. 
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747-400 System 

Mode: Localizer • Goal: Find and track the localizer 
Representation: Loc button flowbar or approach button flowbar 

Interpretation 

Mode State of System State Available Actions Source AFDS Constraints 
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Disarm Button flowbars go blank, Touch Loc button Pilot Disarms Loc or 

White LOC disapears from App mode 

FMA 




Disengage FMA - green TOGA disappears Engage any other roll mode Pilot/AFDS 

Outcome: AFDS provides guidance to airplane to follow ground track in flight. 
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747-400 System 

Mode: TOGA/Roll Goal: Maintain ground track in flight 

Representation: FMA Display 

Interpretation of 

Mode State System State Available Actions Source AFDS Constraints 



Outcome: AFDS provides guidance to roll airplane wings level, then flys that heading when wings are level. 
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747-400 System 

Mode: HDG Hold Goal: Maintain heading airplane is on after wings are rolled level 
Representation Heading hold button and flowbar 

Interpretation 

Mode State of System State Available Actions Source AFDS Constraints 


. 



Outcome: AFDS provides guidence for airplane to maintain current attitude 
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747-400 System 

Mode: Attitude Goal: Maintain airplane's current roll attitude 

Representation: None 

Interpretation of 

Mode State System State Available Actions Source AFDS Co nstraints 



Outcome: AFDS provides guidence so airplane lands on centerline. Passengers clap. Crew welcomes 

passengers to beautiful San Diego. 
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747-400 System 

Mode: Rollout Goal: Maintain airplane on runway centerline till touchdown (Autoland) 

Representation: FMA shows ROLLOUT 

Interpretation of 

Mode State System State Available Actions Source AFDS Constraints 
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747-400 System 

Mode: VNAV Path Goal: Follow FMC vertical route (pitching to FMC speed) 

Representation: VNAV flow bar (any VNAV armed or engaged), white or green FMA “VNAV SPD 



Outcome: FMC provides guidence to get near next FMC restriction altitude or FMC path (not really MJM) and then calls 
VNAV Path mode 
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VNAV flowbar intervention 

Change altitude window (does not 
affect airplane behavior until 
another mode is engaged) 

Outcome: FMC provides guidence to follow window altitude with pitch to path and A/T to FMC speed 
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747-400 System 

Mode: VNAV ALT Goal: pitch to captured altitude with A/T to FMC speed 

Representation: VNAV flow bar (any VNAV armed or engaged), white^or green FMA “VNAV ALT 



Ignores FMC altitude restrictions. 
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747-400 System 

Mode: FLCH Goal: Reach and maintain window altitude (pitches to manual speed) 

Representation: FLCH flowbar (engaged), green FMA “FLCH” 



Outcome: AFDS provides guidence to get airplane away from the ground 
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Outcome: AFDS provides guiedence to maintain vertical speed 

If vertical speed window is set to 0 then mode maintains current altitude. 
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Outcome: AFDS provides guidence fro airplane to follow window altitude 
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747-400 System 

Mode: Alt Goal: Maintain aircraft at window altitude 

Representation: FMA - ALT 



Notes: 

1. Alt Hold is always available in flight. 

Outcome: AFDS provides guidence to maintain altitude switch was pushed at (mode engages immediatly)' 
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747-400 System 

Mode: ALT (HOLD) Goal: Maintain airplane at altitude switch is pressed at 

Representation: Flow bar on ALT Hold switch, FMA - ALT 





IMMI System 

Mode: VNAV Path Goal: Follow FMC vertical route (pitching to FMC speed) 

Representation: Pitch icon in FMC altitude column, white or green FMA “VNAV SPD” 



Outcome: FMC provides guidence to get near next FMC restriction altitude or FMC path (not really MJM) and then calls 
VNAV Path mode 

printed 4/14/94 







IMMI System 

Mode: VNAV SPD Goal: Follow FMC vertical route (pitches to a speed) 

Representation: Pitch icon in FMC speed column, white or green FMA “VNAV SPD 
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IMMI System 

Mode: VNAV ALT Goal: pitch to captured altitude with A/T to FMC speed 

Representation: Pitch icon in manual altitude column with engine icon in FMC speed column, white or green FMA 

<<T r% ▼ A •w T 1 V ■* ^ 



Outcome: AFDS provides guiedence to get near window altitude and then it calls ALT mode 
Ignores FMC altitude restrictions. 
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IMMI System 

Mode: FLCH Goal: Reach and maintain window altitude (pitches to manual speed) 

Representation: pitch icon in manual speed column, green FMA FLCH 



printed 4/14/94 





747-400 System 

Mode: TO/GA - Pitch Goal: Get the Airplane away from the ground 

Representation: FMA display 



Outcome: AFDS provides guiedence to maintain vertical speed 

If vertical speed window is set to 0 then mode maintains current altitude. 
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IMMI System 

Mode: Vertical Speed Goal: Achieve and maintain vertical speed in MCP window 

Representation: Pitch icon with arrow attached, green FMA “V/S” 



Outcome: AFDS provides guidence for aiiplane to follow window altitude 
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IMMI System 

Mode: Alt Goal: Maintain aircraft at window altitude 

Representation: Pitch icon in manual altitude column with engine icon in manual speed column 
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IMMI System 

Mode: ALT (HOLD) Goal: Maintain airplane at altitude switch is pressed at 

Representation: Button in center of altitude knob, Green VPD line at the altitude button is pressed at, FMA - ALT 
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IMMI - SFO to LAX 


May 22,1995 
Rev 


ATC Script 


This is a flight starting at the holding short position of runwayOIR at the San 
Francisco International Airport. The crew will enter the flightdeck with engines 
running. All checklists through the Before Take-off Checklist will have been 
completed. The only preflight tasks to beperformed by the crew will be set up of 
the MCP and loading the FMC. Afterobtaining ATC clearance, they will takeoff 
and proceed to the Los Angeleslnternational Airpo.rt via a normal routing. There 
will be no malfunctions along the way. 


IP1 SFORWYOIR 
N 37.605 
W 122.381666 
HDG 130 
Altitude lift. 


InitialConditions: 

GW - 190,000 Ibs.(ACFS) 620,000 lbs (747) 
Fuel - 30,000 lbs. (ACFS) 100,000 lbs (747) 
” Altimeter - 29.92 
Wind -0/0 


Weather: 

SFO - Clear, 50 nm vis 

Enroute - Clear, 50 nm vis., TURB - Level 4, FL280 thru FL360 

Level 1 at FL370 
$ 

LAX - C l ear, 50 nm v i s . CIG1500 OCST 5 FZ TOPS REPTD 3500 


Airborn IP f -; 

This is a flight starting at approximately 50 nm prior to top of descent forthe 
SADDE 5 arrival for Los Angeles International Airport . The onlypreflight tasks to 
be performed by the crew will be set up of the MCP andloading the FMC. After 
obtaining ATC clearance, they will proceed to the-Los Angeles International 
Airport viaa normal routing. There will be no malfunctions along the way. 


IP2 APPROX 50 nm prior T/D 
N 35.750 
W 120.016666 
HDG 130 
Altitude FL330 
Speed/Mach 0.82 


InitialConditions: 
GW - 190,000 lbs. 
Fuel - 30,000 lbs. 
Altimeter - 29.92 
Wind - CALM 


% 


■ 
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ATC PHRAESOLOGY 


(After crew calls for clearance) 

SFO CLR- NASA20W- 8001 IS CLEARED TO THE LAX AIRPORT VIA 

THE PORTE 9 DEPARTURE, AVE TRANSITION, 

FLIGHTPLAN ROUTE. MAINTAIN FL23 & 6000, EXPECT 
FL330 10 MINUTES AFTERDEPARTURE. 

DEPARTURE FREQUENCY WILL BE 135.1, SQUAWK 
3724. DO NOT EXCEED 250 KNOTS UNTIL ADVISED. 

(After the crew calls for takeoff) 

SFO TWR: NASA8001, AMEND YOUR CLEARANCE, CROSS PORTE 

ABOVE 9000 AND BELOW 1 1000 FEET. TAXI INTO 
POSITION AND HOLD, RWY 1R. 

(Give the crew time to enter the alt and take position) 

SFO TWR: NASA8001, WIND Calm, CLEARED FOR TAKEOFF 

(When the cab leaves 500) 

SFO TWR: NASA8001 , CONTACT BAY DEPARTURE 

(After crew calls) 

V 

BAY DEP: NASA8001 BAY DEPARTURE, RADAR CONTACT. 

MAINTAIN 6,000 

(When cab’s heading is 200) 

BAY DEP: NASA8001 , TURN R I GHT TO 23a LEFT TO 180 FOR 

SPACING 


(After 30 seconds) 

BAY DEP: NASA8001 , TURN LEFT RIGHTTO xxx, INTERCEPT AND 

RESUME THE PORTE 9 DEPARTURE 

(As cab approaches 6»00Q 3,50(j\ 

BAY DEP: NASA8001 , CROSS PORTE ATOR BELOW 1 1 ,00 0, 

CLIMB UNRESTRICTED AND MAINTAIN 15,000 

(As cab approaches 10,000) 

BAY DEP: NASA8001 , CONTACT OAK CENTER ON 1 25.45 

(After crew calls) 
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OAK 12L: 


NASA8001 OAK CENTER, ROGER 


OAK 12L: 


OAK 12L: 


(As cab approaches 15,000) 

NASA8001, CLIMB AND MAINTAIN FL240, RESUME 
NORMAL SPEED 

(As cab approaches 20,000) 

NASA8001, CONTACT OAK CENTER ON 133.7 


OAK 15H: 


OAK 15 F L 


(After crew calls) 

NASA8001 FLxxx ROGER 

(A c cab approacho c 21,000 ) 

MASA9P01-. CLIMB AND MAINTAIN FL290, EXPEDITE 
THROUGH FL240 FL250 


OAK 15H: 


OAK 15H: 


LAX 26H: 


(At 25,000) 

NASA8001, CLIMB AND MAINTAIN FL370 -TURBULENCE 
(At OAK/LAX border) . 

NASA8001, CONTACT LAX CENTER ON 124.15 
(After crew calls) * p ^ 

NASA8001 LAX CENTER FL370 ROGER 
(At .84) •' 


Note for the researchm^L the ACF£ is una ble to m in asgeed in qxqssS. oLMa ch 

.85 


LAX 26H: 


NASA8001, CLEARED FOR THE SADDE 5 ARRIVAL 
DESCEND AT PILOT’S DISCRETION, CROSS SIMON AT AND 
MAINTAIN 12,000 . BEG I N YOURDESCENT AT THE F1M 61 DME r 
AT 280 KNOT-Sr LAX ALTIMETER29.92 


-OR- 

(Between .82 and’. 84) 

3H: NASA8001 , CLEARED FOR THE SADDE 5 ARRIVAL. 

CROSS SIMON AT AND MAINTAIN T2.000. BEGIN 
YOURDESCENT AT THE f=IM 58 DME, AT 280 V 
KNOTS, LAX ALTIMETER29.92 
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> •' V 

* 

* •. 

-OR- 

(Below .82) 

* 

LAX 26H: NASA8001 , CLEARED FOR THE SADDE 5 ARRIVAL 

CROSS SIMON AT AND MAINTAIN 12,^000. BEGIN 
YOURDESCENT AT THE FIM 50 DME, AT 280 
KNOTS, LAX ALTIMETER30.01 

(When cab approaches 24,000) 

LAX26H: NASA8001 , CONTACT LAX CENTER ON 1 32.6 

(After crew calls) 

% ' • 

NASA8001 FLxxx, ROGER 

(When cab passes 13,000) 

NASA8001 CONTACT SOCAL APPROACH ON 124.5 

(After crew calls) 

SOCAL APP:NASA8001 SOCAL APPROACH ROGER, CROSS SADDE 
AT 250 KNOTS AND BAYST AT 10,000 

(When cab passes SADDE) 

Note f_or the researcher: It the crew loads, and e xecutes the IL$ 24 R, they, mil b g 

unablg to chanoeto an ILS 25L ^ 

SOCAL APP:NASA8001, DEPART SMO HEADING 070 FOR 
VECTORS TO THE FINAL APPROACH 
COURSE. BEADV I S5 B- EXPECT ILS 24L R 

APPROACH. IF 25L BEOOMES AVAILABLE, -I WILL CHANGE YOUR 
RUNWAY. 

(When cab passes BAYST) 

SOCAL APP:NASA8001, REDUCE SPEED TO 200' 

(When cab passes SMO) 

SOCAL APP:NASA8001, DESCEND AND MAINTAIN 5,000 

(When cab passes 6,000) 

SOCAL APP:NASA8001 REDUCE SPEED TO 180 


LAX14L: 


LAX14L: 
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(When cab a ppro a ch es FANGY is 1 mi east of SAPPI) 

SOCAL APP:NASA8001, TURN RIGHT HEADING 160, FOR VECTORS 
TO THE FINAL APPROACH ILS 24R. DESCEND 
AND MAINTAIN 4,000 

s’ 

(As cab passes 4,500) 

SOCAL APP:NASA8001 REDUCE SPEED TO 170 

(When cab approaches final) 

SOCAL APP: NASA8001 , xx MILES FROM LIMMA ROMEN, TURN RIGHT 

HEADING 220, MAINTAIN StOOO 4000 UNTIL ESTABLISHED ON THE 
LOCALIZER, CLEARED FOR I LS25 U ILS24R APPROACH 

(When LOC and G/S have engaged) 

P 

SOCAL APP: NASA800 1 , xxx MILES FROM LIMMA, TURN LEFT HEADING 220 
VECTOR FOR THE ILS25L LOCALIZER, MAINTAIN 3000 UNTIL 
ESTABLISHED, CLEARED FOR THE ILS25L APPROACH. 


(When cab is on final) 

SOCAL APP: NASA8001, MAINTAIN 170 KNOTS TO LIMMA, 
CONTACT LAX TOWER ON 120.95 


After crew calls) 

LAX TWR: NASA8001 LAX TOWER, WIND CALM, CLEARED TO 

LAND 25L 

(When cab approaches taxi speed) 

LAX TWR: NASA8001 JUST STOP ON THE RUNWAY 


i 
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SCENARIO 


SFO-LAX 


SFO . . PORTE9 . AVE . FIM . FIM 6 . . LAX 
PL 330 (note this 

clearance 


FL is lower than the final ATC 
We are looking for a problem here. 


) 


Departure Clearance 


"NASA eight hundred is cleared to the Los Angeles International 
Airport as filed, on departure fly heading 281 to the Porte 9 
departure cross Porte above niner thousand and at or below one one 
thousand, climb and maintain six thousand, expect higher one zero 
minutes after departure, do not exceed two hundred fifty knots until 
advised, departure frequency will be one twenty one point three, 
squav;k 3654 . " 


or 


if Departure Clearance by ACARS: 


* *DPTR CLRNC* * 

FLT 800 SFO - LAX 
NASA800 KSFO 
/B7 57 / P1815 RQ330 

XPDR 3654 

MAINT 6000 CROSS PORTE 
ABOVE 9000 AND BELOW 
11000 EXP REQ ALT 10 MIN 
AFT T/O 

GND CTL FREQ 121.8 
/DPTR CTL SEE SID 
DO NOT EXCEED 250 KTS 
UNTIL ADVISED 
EXPECT RWY 28L DEPT 
KSFO . PORTE9 . AVE .FIM. 
FIM6. .LAX 


7747-4/ for the -400 


A/C Call for push back clearance 
Ground: 

"NASA eight hundred, clear to push" 

A/C Call for taxi clearance 

"NASA eight hundred, taxi to runway 28L via the inner and Foxtrot 
[Note: 747-400s are restricted from using taxiway E to or 
from taxi way B] 


Normal takeoff clearance. 


After Takeoff and prior to 1000': 
"NASA 800 contact departure" 




NASA 800 checks in with departure " “ 

"NASA 800 Bay departure radar contact" 

Radio chatter from other pilots in area 

We expect the crews to be flying in LNAV and VNAV with A/P engaged 
before reaching the first turn point. 

________ ============= == The SID calls for a 101 degree left turn. 

Upon rolling out on the 180 degree heading 

“NASA eight hundred, turn left 10 degrees for traffic." 

30 seconds later 

"NASA eight hundred, resume the Porte 9 departure." 

What we expect to see: 

MCP : Possible engagement of heading select with the heading bug behind 
the airplane. 

IMMI : pilot has to find the heading bug in order to engage the mode. 
Can't make this mistake on our interface. 

Rationale: It's been observed in training and from the jumpseat . It 
will be important to keep the crew busy looking for traffic while the 
airplane is making the turn in LNAV. 


____ ======== - == = ( set up an unexpected VNAV level-off) 

Out of 5000' 

"NASA 800 climb unrestricted to one five thousand." 


What we expect to see: 

MCP: We have now set up the analog of the Peblel departure from SAN. 
They will put 15000 in the window, but an at-or-below altitude 
restriction remains at PESCA. May see an unexpected level off. It will 
be essential to have the performance characteristics worked out so 
that the airplane will reach 10000 prior to Porte. Since Porte 
normally required at-or-above 9000, this should be assured in a light 

747-400 . 

IMMI: The vertical path display should make the level-off apparent. 

________- ============ === (hand off to Center) 

Out of 11000' 

"NASA 800 contact Oakland Center on 125.45" 


_______ =========== ====== (clearance higher) 

Let them level at FL150 
When level at FL150 

"NASA 800 climb and maintain FL290" ’ ' 

• 

========================= (set up wingtip LNAV) 

after crossing Porte 

"NASA 800 turn left 20 degrees for traffic" (to 115) 

This has the effect of cutting the Pesca waypoint corner of the route 

__.____ = = == - == - = = = = = = = = = =: (wingtip LNAV) 

When almost abeam of Pesca 

"NASA 800, traffic no factor, resume the Porte 9 departure, thanks for 




your help . M 

What we expect to see: 


MCP: Possible engagement of LNAV with active waypoint abeam. This 
produces a steep right turn toward Pesca when pilots expect a shallow 
left turn to line up with Wages waypoint in front of them. 


IMMI : Pilots have to find the active waypoint to engage the mode, 
should be obvious that it's off the end of the wing. 'So, they go to 
CDU and make the next wpt active, then engage it.' 


Rationale: MCP LNAV is a "meta-button. 11 It has no content. IMMI's 
engagement operation requires the pilot to interact with the spatial 
meaning of the operation. . 


___ = _ ===== - == ==:========= (hand off to Center 2) 

Out of FL210 

"NASA 800 contact Oakland Center on XXXXXX" 


(<- need freq) 


A/C "Oakland Center NASA 800, out of 220 for 290." 

______- == - === - ====== === (Center 2 pick up and expedite climb) 

"NASA 800 roger, expedite your climb through FL240." 

Features: Speed intervention is not shown as available on either 
interface The (someday) blue speed select button on the IMMI gives a 
clue that something is available there. Two problems here . 1) Getting 

a mode or sub-mode that will control speed. 2) What is the best rate 
of climb' speed right now? 


What we expect to see: 

MCP* "how do I find that? 250 ought to be about right." The 
right way to do it is to go to the VNAV page in the CDU. Field 6R of 
the VNAV page shows Vx. And from school you remember that you can 
get a good approximation of Vy by adding 25 Knots to Vx. 

IMMI: If they can get into speed intervention, setting the icon next 
to the Vy bug should be easy. 

__________- ========== (resume normal speed, final alt clearance) 

out of FL250 
“NASA 800 


resume normal speed, (if pilots forgot to resume on own) 

(or) 

climb and maintain FL370 
thanks for your help." 

_ = - = - = - ====== ======= (possible unexpected level off at cruise) 

Final clearance is higher than initial clearance entered into CDU as 
cruise altitude. This is a hidden state in the MCP system. 

f 

What we expect to see: 

MCP: 

Expect that the pilots may not edit the cruise page in the CDU to 
reflect the final ATC clearance ..and will be surprised- when the 
airplane levels prior to the altitude in the MCP f . window, 

IMMI : ’ , ' 

Expect that the pilots will notice the magenta line levels prior to 

the window altitude line and they will edit the CDU to 'change cruise 
altitude to reflect the final ATC clearance. 




__________ =========== ======== (Descent Clearance:} ' 

"NASA 800 cleared for the Runway 24/25 Profile descent 


_______________ = _= ====: = = = = = = = (Over Speed lose path) 

During descent a tail wind forces the airplane to use higher and 
higher speeds to stay on the path. As the airspeed approaches the top 
of the operating envelope, the FMC abandons pitching to the path wi 
VNAV PATH and instead pitches to a speed with VNAV SPD. 


What we expect to see: 


(a) scratch pad message "drag required", (b) overspeed warning boxes 
on PFD airspeed tape move toward the current airspeed marker, (c) 
FMA's change from VNAV PTH to VNAV. SPD. The pilots may not notice 
these changes and the mode transition. 


T MM I • 

(a) VPD predicted path will diverge from the FMC path at the 4D point 
of the expected mode transition, (b) the IMMI current airspeed window 
will climb up on the speed tape toward the overspeed warning area, (c) 
the pitch to path icon will turn amber, (d) the pitch and engine icons 
will P swap sides of the IMMI when VNAV PTH changes to; VNAV SPD, (e) all 
the changes above for the MCP will also occur. We expect the pilots 
w iH notice these changes before the mode transition occurs. 


More clearances need to be written here for standard descent. 
Los Angeles Airport information Sierra, 1650 zulu. ... 


Somewhere in here 
"Expect runway 24R. " 


East of Santa Monica: 

"NASA 800 descend and maintain 5000'" 


Over down-town: . 

"NASA 800 turn right heading 160 descend and maintain 400U 

Expect to see: use of V/S to make a smoother decent ‘from 5000 to 4000 
The IMMI will have the opportunity to show its awkward V/S interface 
which may be harder to use than the -400. 

^NASA 1 800 U turn right heading 220 vector to the runway 24R localizer, 
cleared for the runway 24R approach." x v 


The vectors, altitudes, and approach clearance must be given m such 
way that LOC and G/S can engage well outside the outer marker. The 
altitude of the glideslope at Merce is 4783 MSL. Joining the localizer 
at 4000 will lead to G/S intercept about 6 miles outside of Romen. 

Once the aircraft is locked in on 24R, . . 

ATC calls for a runway change. (This works in the Boeing Datalmk 

study scenario, consult that for details) . 

"NASA 800, 24R glideslope signal is fluctuating, ^ ur ^J;® ft 

220 vector for the Runway 25L localizer, cleared to land, runway 25L. 


Expect to see: 


BOTH: 




Difficulties in disengaging from the LAND configuration 
Vindication that TOGA is the only mode available. 

Information available Perceptually that 

that they have to disengage everything to get anbther pitch or roll 
mode . 


On _ l mile” finali" another aircraft moves onto 
"NASA 800 go around fly the published missed 


the runway . 
approach . 


A/C acknowledge 

"NASA 800 contact departure on 124.3 

A/C -Departure, NASA 800, missed approach o£f 25L- 

-NASA 800 climb and maintain 3000 proceed to the INISH intersection as 
published hold west on the SEAL BEACH 251 degree radral, left hand turns 

Release from hold and normal landing on 25L 




